[barbatdev]

Linked Issue

Refs #374

Umbrella: #401

PR Type

• type:feature Feature
• type:bug Bug fix
• type:docs Documentation
• type:refactor Refactoring
• type:chore Maintenance
• type:breaking-change Breaking change

Summary

List sorted admitted profile ids through the existing strict decoder and expose one safe default/id snapshot for refusal diagnostics. This dependency-only API slice has its own tests; the public diagnostic consumer follows later.

Changes

This is slice 2/8, 134 authored changed lines. Code, focused tests and applicable operating documentation stay together. Exact reviewed source commit: eafc30d23721577da364299724294d2b9de46d6a. Delivery head 9ddf139afdf211062d250f03036f7bb29525def6 has the identical complete source tree.

Focused Tests

Each cumulative prepared slice passed go test ./internal/cli ./internal/qapi ./internal/qaroute ./internal/installobserve -count=1, go vet ./... and whitespace checks. Final candidate additionally passed go test ./... -count=1, go vet ./..., go test -race ./... and all 15 repository Python policy tests on a byte-verified canonical clean snapshot. Independent source-agreement, typed-admission and final security verification passed with no severe blockers; final verification observed 19 named tests plus four package suites/vet.

Native assessment of this exact slice: medium native tier, reviewDue=false (under_budget); no new native review started. Security-affecting slices retained explicit high-risk escalation and independent verification rather than treating assessment as proof. Parser's separately requested native review completed approved and acknowledged.

Runtime Harness

Disposable public CLI fixtures, no real provider calls. Rejections pin no launch/write effects, route identity and safe profile tokens. macOS /tmp is a symlink and intentionally refused: canonical snapshot cwd passed unchanged guards. No credentials changed.

Rollback

Revert this slice. Revert any dependent later slice first; no stored-data migration.

Chain Dependencies / Out of Scope

Sequential verified-main strategy: merged #402 -> [current slice 2/8] -> remaining slices. This PR targets main only after its predecessor lands, so its diff contains only this work unit. Do not close the umbrella from this intermediate slice.

Known acceptance limit: #329's literal transient/persistent causal distinction is NOT established by stage reporting and remains open. Defensive untyped branches, a currently unreachable non_nan_route mapping and a brittle wording assertion were disclosed as nonblocking verifier advisories, not silently fixed. Provider transport #345 and lifecycle #373 are out of scope.

Checklist

• Linked issue is open and status:approved.
• Exactly one matching type:* label is applied.
• Focused tests and runtime harness evidence are recorded.
• Rollback and out-of-scope boundaries are documented.