Sync Agent Policy

One local policy file is the source of truth. This skill maps it onto each harness — it does not copy one agent's config onto another.

Hard Rules

Policy file is SSOT. User paths live in ~/.config/agent-policy/policy.toml, never in this skill. Why: the skill is public; the deny list is personal.
Status first; write only on explicit apply. apply is dry-run unless --write. Why: these files also hold allow-lists and unrelated hooks.
Merge deny, keep everything else. Union missing tokens into deny. Do not replace allow, ask, MCP, or permission_mode.
Emit native tokens. ~/ and // are not portable. Mapping is in references/adapters.md.
Do not replace an existing regular guideline file. Only create missing files or retarget our own symlinks.