[hakula139]

Summary

Permission configuration was parsed during per-file validation and again while constructing policy. This PR compiles sourced rules and validates extra roots once after the layers merge, retaining each entry's original file context and rejecting invalid lower-layer values.

• Loading: each file still receives typed schema and project-key validation. Merged list entries are compiled once with their source provenance, including values contributed by lower layers.
• Policy: config passes compiled deny, ask, and allow rules plus validated anchors to permission. Config retains provenance while permission retains workspace root invariants.
• Contracts: unused serialization derives are removed, deserialization contracts remain tested, and verdict documentation accounts for current path-prefix checks.

Test plan

• Regressions cover lower-layer validation, per-file schema rejection, error provenance, deserialization names, and extracted shell behavior.
• Full local verification at 2559e7a39 passed: formatting, build, both Clippy runs, rustdoc, coverage, pnpm format/lint/spellcheck, and hooks. 3,497 tests passed with five existing paid-live tests ignored. Line coverage is 99.24%.
• Exact-head CI passed at 8c4361a10, including Rust on Linux, macOS and Windows, MSRV, lint, both Nix builds, CI Result and Codecov.
• The uncovered config error guard accepts only Source::File; permission-list entries come from file layers, so other sources cannot reach this path.

[codecov]

Codecov Report

❌ Patch coverage is 99.63235% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/ox-core/src/config/load.rs	99.29%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!