feat: Python porting workspace with reference data and parity audit

src/permissions.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+@dataclass(frozen=True)
+class ToolPermissionContext:
+    deny_names: frozenset[str] = field(default_factory=frozenset)
+    deny_prefixes: tuple[str, ...] = ()
+
+    @classmethod
+    def from_iterables(cls, deny_names: list[str] | None = None, deny_prefixes: list[str] | None = None) -> 'ToolPermissionContext':
+        return cls(
+            deny_names=frozenset(name.lower() for name in (deny_names or [])),
+            deny_prefixes=tuple(prefix.lower() for prefix in (deny_prefixes or [])),
+        )
+
+    def blocks(self, tool_name: str) -> bool:
+        lowered = tool_name.lower()
+        return lowered in self.deny_names or any(lowered.startswith(prefix) for prefix in self.deny_prefixes)