feat(policy,komodo,config): vault zone and firefly skill rules, komodo python_tool with exec, tests

README.md

@@ -129,6 +129,25 @@ Needs `KOMODO_URL` / `KOMODO_KEY` / `KOMODO_SECRET` in `.env` (and
 `POST /hooks/komodo` the same way - they land in the master as an urgent
 inject. Jobs, the queue and the subscription window are on the admin **Jobs** page.
 
+The same key backs the `komodo` tool the dispatcher and deep chats get
+(`mcps/komodo.py`, архитектура §4.4): one MCP tool with an enumerated
+`action` - `status`, `stacks`, `containers`, `logs`, `search_logs`, `updates`,
+`update`, `deploy`, `restart`, `exec`. `exec` is `docker exec` into any
+container of the fleet except infrastructure ones (`exec_deny`, periphery by
+default); prune, destroy and a host terminal do not exist in the enumeration,
+so they cannot be asked for. The key never reaches the model process.
+
+## Policy (`policy.py`)
+
+`bypassPermissions` everywhere; the boundary is the read-only vault mount
+plus `PreToolUse` rules declared per agent (`ClaudeAgent.policy`, архитектура
+§3.7): writes only under `мета/бобер/`, new files only under `💬 чаты/`,
+`rm`/`mv`/`cp`/`tee`/`sed -i`/redirects into the vault outside those zones
+are refused with a reason, and `mcp__firefly__store_*`/`update_*` need the
+`firefly` skill opened first in the same session. Every tool call lands in
+the admin **Audit** page as `tool_call`. Run `make check` - it includes the
+policy and komodo tests.
+
 ## Editing config.py on the mac
 
 `make sync` installs `../beaver-gateway` editable (extra `local`), so