Permission Mode Lives in APX, Not APC
APC is the portable context layer. APX is the daily-use runtime and tooling layer. That split is the reason permission mode belongs in APX, not in the repo.
Permissions are not project truth. They are machine policy.
That sounds small, but it matters. A repository should travel cleanly across laptops, desktops, and runners. A permission setting should not force the same risk level everywhere the repo lands. If you bake permission state into APC, you make the project less portable and mix local trust with shared context.
What APX actually stores
