One verified resource source
Before and after authorization topology. Mechanical merge keeps a fixed-path grant independent of verification. The integrated implementation removes that input, routes only the verified root through read-only rules, and isolates resource failures from other configuration. This is an architecture diagram, not a product screenshot.
OPEN DESIGN · #9060 + #9073 INTEGRATION
One verified resource source
BEFORE · mechanical merge
INTEGRATION CHANGES
AFTER · integrated candidate
L · LOADER
Verified asset loader
taskProfileRoot | null
F · REMOVED −
Independent fixed path
P · CHANGED Δ
Read-only permission options
Fixed root + edit-base probe
Probe failure skips config build
C · CONFIG
Dynamic OpenCode config
project + MCP + BYOK
A · RUNTIME
OpenCode child
normal + BYOK
L · LOADER
Verified asset loader
taskProfileRoot | null
P · CHANGED Δ
Read-only permission options
Verified root + edit-base probe
Failure withholds only this grant
C · CONFIG
Dynamic OpenCode config
project + MCP + BYOK
A · RUNTIME
OpenCode child
normal + BYOK
REMOVED F
No independent hardcoded directory.
REMOVED fixed-grant
No fallback path can restore access.
REWIRED verified-root
Loader → read-only policy → config.
CHANGED P
Probe failure omits the resource;
project, MCP and BYOK remain.
− Removed input Δ Changed policy Same node IDs retain the same coordinates.
Architecture comparison only. Runtime evidence and validation limits are documented separately.