fix(cua-driver): enforce authorization in embedded SDK

docs/content/docs/concepts/sdk-mcp-and-hosting.mdx

@@ -47,6 +47,12 @@ MCP remains valuable because it standardizes discovery, calls, results, tasks,
 and transport for agent runtimes; the generated language SDKs are for
 applications embedding the native runtime.
 
+Authorization is part of the native runtime, below this topology choice. A
+same-process `CuaDriver.create()` call and a daemon-backed call both pass the
+same registry authorization boundary before platform dispatch. MCP, HTTP, CLI,
+and daemon adapters may reject a call earlier for defense in depth, but they do
+not replace or weaken that native check.
+
 ## Why the daemon still exists
 
 External agents and CLI calls are short-lived or run outside the desktop app

docs/content/docs/reference/cua-driver/permission-modes.mdx

@@ -5,9 +5,10 @@ description: Standard, bounded, and unrestricted startup modes, protected consen
 
 import { Callout } from 'fumadocs-ui/components/callout';
 
-Cua Driver resolves one permission mode when the daemon starts. A tool call
-cannot change the mode. The mode controls when work stops for protected human
-approval; permission policies still decide which calls are allowed.
+Cua Driver resolves one process permission mode when a same-process runtime or
+daemon starts. A tool call cannot change the mode. The mode controls when work
+stops for protected human approval; permission policies still decide which
+calls are allowed.
 
 ## Modes
 
@@ -32,8 +33,8 @@ Passing `--permission-mode unrestricted` without that flag still fails closed.
 
 ## The authorization stack
 
-Every daemon transport reaches the same authorization coordinator. A call
-must pass each active layer:
+Every same-process SDK call and daemon transport reaches the native registry's
+authorization coordinator. A call must pass each active layer:
 
 1. The reviewed built-in tool and risk map.
 2. The administrator policy from `CUA_DRIVER_MANAGED_POLICY_FILE`, when set.
@@ -45,9 +46,26 @@ Each layer can narrow access. Approval and unrestricted mode cannot widen a
 policy layer. An unknown tool has no reviewed risk class and is denied.
 
 Tool-list and description responses include risk metadata with `class`,
-`enforcement`, `operation_sensitive`, and `version`. The first active adapter
-is `browser_prepare` with `strategy.kind=existing_profile`. Other listed risks
-are `metadata_only` until their resource, output, and revocation adapters ship.
+`enforcement`, `operation_sensitive`, and `version`. The top-level
+`enforcement_adapters` array gives the stable adapter ID, exact operation
+selectors, resource scope keys, grant TTL, indicator requirement, revocation
+triggers, refusal code, and provider requirement.
+
+The current inventory is intentionally narrow:
+
+| Adapter | State | Meaning |
+| --- | --- | --- |
+| `browser_prepare.existing_profile` | `active` | Existing-profile attachment applies the mode-specific protected-consent or unrestricted path. |
+| `private_observation` | `metadata_only` | User-window/display observation is classified but not protected by a shipped grant adapter. |
+| `desktop_input` | `metadata_only` | Generic desktop input is classified but not protected by a shipped grant adapter. |
+| `file_transfer_and_output` | `metadata_only` | Uploads, downloads, and screenshot-to-file egress are classified but not protected by a shipped grant adapter. |
+| `browser_consequential_action` | `metadata_only` | Mutating dialogs and generic page actions are classified but not protected by a shipped grant adapter. |
+| `devices`, `shell_and_network` | `not_exposed` | Cua Driver does not expose these open-ended capabilities. |
+
+`metadata_only` is classification, not runtime consent enforcement. These
+groups remain metadata-only until an exact resource adapter, certified
+protected host, persistent Stop indicator, revocation path, and representative
+platform tests all ship.
 
 ## Protected consent
 
@@ -157,6 +175,12 @@ Setting only the mode or only the acknowledgement fails before the daemon
 binds. Treat these as trusted-launch configuration, not tool arguments an
 agent can choose at runtime.
 
+One process still has one mode and, in bounded mode, one immutable manifest.
+Shared-daemon per-session mode selection is not yet a supported security
+boundary. Run one daemon per mode unless the host can supply an authenticated
+session/action connection; caller-chosen session IDs are lifecycle labels, not
+credentials.
+
 ## Managed controls
 
 Set `CUA_DRIVER_MANAGED_POLICY_FILE` to apply an administrator-owned YAML or
@@ -169,9 +193,10 @@ then rejects unrestricted startup even when the danger flag is present.
 
 ## Status and revocation
 
-`cua-driver status` reports the effective mode, policy hashes, session-manifest
-hash and expiry, active risk adapters, and protected-provider availability. It
-does not print policy contents or browser data.
+`cua-driver status` reports the process mode, policy hashes, session-manifest
+hash and expiry, active/metadata-only/not-exposed adapter IDs, the complete
+content-free adapter inventory, and protected-provider availability. It does
+not print policy contents or browser data.
 
 End one session and every grant it owns:
 

docs/content/docs/reference/cua-driver/permission-policies.mdx

@@ -5,7 +5,7 @@ description: YAML and Rego permission policy schema, environment variable, evalu
 
 import { Callout } from 'fumadocs-ui/components/callout';
 
-Cua Driver evaluates every daemon tool call against the configured policy stack. The daemon loads policies once at process startup; the MCP proxy may repeat the user-policy check as defense in depth. CLI, MCP, and raw-socket calls share the daemon enforcement point. This page describes the user and managed policy formats. [Permission modes](/reference/cua-driver/permission-modes) control when a permitted call also needs protected approval.
+Cua Driver evaluates every same-process SDK and daemon tool call against the configured policy stack at the native registry boundary. The runtime loads policies once at process startup; transport adapters may repeat an early policy check as defense in depth. SDK, CLI, MCP, and raw-socket calls cannot bypass the native enforcement point. This page describes the user and managed policy formats. [Permission modes](/reference/cua-driver/permission-modes) control when a permitted call also needs protected approval.
 
 ---
 

docs/content/docs/reference/cua-driver/sdk-reference.mdx

@@ -24,6 +24,13 @@ asynchronous. Python uses `snake_case`; TypeScript uses `camelCase`.
 `claude_code_compatibility` / `claudeCodeCompatibility`, which defaults to
 `false`.
 
+`create()` validates the immutable permission-mode, managed-policy,
+user-policy, and bounded-manifest startup configuration before constructing
+the native runtime. Every subsequent same-process call passes the same native
+authorization coordinator used by daemon-backed calls. An invalid
+configuration returns `DriverError.Configuration`; a denied generic call
+returns a tool error with stable code `permission_denied`.
+
 `execution_mode()` / `executionMode()` reports the generated
 `DriverExecutionMode` value. The current enum variants are `Embedded` for the
 same-process runtime and `Daemon` for a socket-backed connection.
@@ -73,8 +80,9 @@ explicit escalation before desktop tools are enabled.
 | `hotkey`              | `hotkey`            | `HotkeyInput`            |
 
 Use `list_tools_json()` / `listToolsJson()` and `call_tool()` / `callTool()` for
-the generic, platform-extensible tool surface. Prefer typed methods when one is
-available.
+the generic, platform-extensible tool surface. Its top-level
+`enforcement_adapters` array distinguishes active, metadata-only, and
+not-exposed permission adapters. Prefer typed methods when one is available.
 
 ## `ToolResult`