Phase 2: Allow, Ask first or Off for each tool, with a recommended set #364

Phase 2 of the product plan: every tool has one of three modes, Allow, Ask first or Off, and the owner can apply a recommended set in one click.

Most of the model already exists: per-app roles (#286), single-tool off switches, the preview and confirm gate, Needs your OK (#287) and "Publishing needs my OK". What is missing is Ask first: a change that runs only after the owner approves it in wp-admin, not on a "yes" in the chat.

Decisions (taken 2026-10-14 on Fahim's "take whatever decision you need")

1. Modes are per tool and site-wide. Allow (the default), Ask first, Off. The app's role (Read only, Edit content, Manage the site) stays the ceiling; a mode can only narrow it. Off is the existing "turn off" switch, same option.
2. Ask first: the call returns a preview and waits under Needs your OK. It runs only after the owner approves it there; the app then calls again with the token. A "yes" in the chat is not enough. A request made from the owner's own browser session is not asked.
3. Ask first is offered only for tools that change something. Read tools are Allow or Off.
4. New tools arrive as Ask first (R3; ADMIN-SYSTEM.md 6.7). A write tool added by a later update, or by a plugin activated later, asks first until the owner chooses. Every tool that exists when this ships keeps exactly what it does today.
5. A fresh install stays read-only: apps start at Read only, so every write is blocked (non-negotiable WP.org submission: readme, screenshots, assets #2). Nothing here changes that.
6. Recommended set, one click, never applied by itself, and it only tightens. Ask first for: deleting posts, pages, media, menu items and memory; undo; activating and deactivating plugins and themes; plugin, theme, core and translation updates; installs; auto-update; options; module settings; template overwrites. It also turns on "Publishing needs my OK". Content edits stay Allow. A tool that is Off stays Off.
7. The confirm token stays single-use and 15 minutes.
8. No tool can change a mode (Saddle_Settings_Guard).
9. UI: Settings → Advanced, "Turn off single tools" becomes "What each tool may do": Allow / Ask first / Off per tool, a "New" tag on tools that arrived as Ask first, and a "Use the recommended set" button.

Done when

• Ask first works on tools with their own gate (delete-post, …) and on tools without one (create-post, set-blocks, …): a preview, no change, the confirm refused until the owner approves, then it runs exactly once; a reject stops it.
• Tests pin R3: a site updated in place can do exactly what it could before; a new tool arrives as Ask first; a fresh install is read-only (DB row).
• The recommended set only tightens.
• The context tells the app which tools ask first.
• Settings shows the three modes.