diff --git a/AGENTS.md b/AGENTS.md
index 4bc259f..16ba16a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,7 +17,7 @@
 
 ## Restricciones
 
-- Funcionalidad nueva solo dentro del veredicto vigente (CONDITIONAL-CLEAR hasta MVP-5: catálogo de matriz, UI de cinco pasos de esa matriz, paridad Tauri/WASM); el rail de Forge sigue en seis pasos y no se elimina ninguna pantalla. Runner, imagen real, root, discos y shell siguen cerrados hasta un alcance `accepted` adicional y una reevaluación del veredicto.
+- Funcionalidad nueva solo dentro del veredicto vigente (CONDITIONAL-CLEAR hasta MVP-5, más el slice ISO-01 de imagen viva x86_64 UEFI: perfil archiso, una corrida `mkarchiso` en proceso separado y arranque vivo). El recorrido de la cara es Sistema base → Entorno → Apps → Identidad y seguridad → Revisión. El paso Disco y particiones sale de ese recorrido por orden del operador (2026-10-18). Siguen cerrados el runner de instalación, root, discos (A6), shell arbitraria y aarch64. Sin la línea ISO-01 de `go-no-go.md` no hay exporter ni `mkarchiso`.
 - No ejecutar strings heredados `cmd`, hooks, `pacstrap` ni shell.
 - Rust es la única autoridad semántica; TypeScript no duplica reglas.
 - MVP no usa root, discos, shell, sidecars ni instalación real.
@@ -37,7 +37,7 @@
 - La siguiente fase se especifica desde el último plan implementado, el roadmap de `docs/10-delivery/` y el trabajo pendiente, sin ampliar el veredicto vigente.
 - No incluir en un commit cambios de `.gitignore` ni artefactos de fugas salvo petición explícita.
 - La GUI se llama Forge (la interfaz gráfica de ArchMaker); el proyecto y el motor se llaman ArchMaker. Neubat queda fuera de la nomenclatura activa y se conserva solo como historia. No inventar pantallas: conectar los botones y controles que ya trae la cara.
-- El flujo de Forge es Disco y particiones → Sistema base → Entorno → Apps → Identidad y seguridad → Revisión (experiencia única; sin Sencillo/Avanzado).
+- El flujo de Forge es Sistema base → Entorno → Apps → Identidad y seguridad → Revisión (experiencia única; sin Sencillo/Avanzado). En Revisión se pide la imagen. No hay paso de disco, particiones, GPT, ESP, LUKS ni formatear. El SSD lo instala archinstall en la sesión viva.
 - En la cara UEFI el arranque preseleccionado es systemd-boot; GRUB y Limine siguen seleccionables.
 - Título visible de ventana/documento/cabecera: ArchMaker Forge; productName Forge e identifier intactos.
 - Protección de `main` sin checks bloqueantes para el dueño y sí ante colaboradores externos.
@@ -46,12 +46,12 @@
 
 - Remoto canónico: `https://github.com/Alexendros/archmaker`. Licencia Apache-2.0.
 - Baseline vigente: `implementation-baseline-mvp5`. En el árbol están el walking skeleton MVP-0 y los slices MVP-1 (dominio, catálogo y migración v5.1), MVP-2 (reglas, resolución y validación), MVP-3 (adapters de exportación), MVP-4 (React + MockCorePort + cara Forge en `apps/web`) y MVP-5 (catálogo de matriz, UI cinco pasos, paridad Tauri/WASM, remediación operativa + Prove-It).
-- Alcance MVP-5 cerrado (`mvp5-scope.md`, MVP-5-01..05). Hueco residual histórico: `docs/10-delivery/mvp5-gap-spec.md` (draft; cara supersedida por incremento Forge 2026-10-17). Remediación operativa: `docs/10-delivery/remediation/`. MVP-6 **accepted** solo AppImage (histórico Neubat `v0.1.0`; nombre visible vigente Forge); release [`v0.1.0`](https://github.com/Alexendros/archmaker/releases/tag/v0.1.0) publicada (verificación parcial: sin cosign local, sin 3× GUI, F7 sin `RC_SHA_FUNCIONAL`). `iso-scope.md` sigue sin `accepted`.
+- Alcance MVP-5 cerrado (`mvp5-scope.md`, MVP-5-01..05). Hueco residual histórico: `docs/10-delivery/mvp5-gap-spec.md` (draft; cara supersedida por incremento Forge 2026-10-17). Remediación operativa: `docs/10-delivery/remediation/`. MVP-6 **accepted** solo AppImage (histórico Neubat `v0.1.0`; nombre visible vigente Forge); release [`v0.1.0`](https://github.com/Alexendros/archmaker/releases/tag/v0.1.0) publicada (verificación parcial: sin cosign local, sin 3× GUI, F7 sin `RC_SHA_FUNCIONAL`). `iso-scope.md` **accepted** el 2026-10-18 solo para imagen viva x86_64 UEFI (ISO-01). El código del perfil y de `mkarchiso` empieza en ISO-02.
 - `reference/v5.1/` es evidencia inmutable verificada por SHA-256. La UI React vive en `apps/web/` (`forge-face.ts`); el dominio está en `crates/archmaker-core` y se expone por CorePort.
 - Arranque de adaptadores vía `apps/web/src/create-core-port.ts`: Desktop → TauriCorePort (`invoke` de `@tauri-apps/api/core`); navegador → WasmCorePort (`tools/build-wasm.sh`); MockCorePort solo con `?mock=1` u opt-in explícito, nunca por fallo silencioso de Tauri/WASM.
 - ADR-0011 (propuesto, `in-review`): la selección del configurador produce un contrato JSON de aplicación; cada cláusula tiene schema en `contracts/json-schema/`, issue `kind:clause` y tests verificados en Rust. No añade target de imagen.
 - Alcance declarativo Forge (draft): `docs/10-delivery/forge-declarative-scope.md`. ADR-0013…0018 (UKI ESP, estados ortogonales, handles, digests v2, ONLYOFFICE/navegadores, A6 excluida). No reescribe `mvp5-scope.md`. Mantener `executionStatus=not-executed` en ese alcance.
-- Cadena de integridad Forge (selección → documento persistido → motor → resolución/validación → UI efectiva → export → reimportación). Registro: `docs/10-delivery/closure/forge-integrity-findings-2026-10-18.md`; matriz: `docs/10-delivery/closure/forge-acceptance-matrix.md`. `StorageIntent` y campos v2 deben llegar íntegros al borrador/`draftForCore`/export; TypeScript no inventa semántica.
+- Cadena de integridad Forge (selección → documento persistido → motor → resolución/validación → UI efectiva → export → reimportación). Registro: `docs/10-delivery/closure/forge-integrity-findings-2026-10-18.md`; matriz: `docs/10-delivery/closure/forge-acceptance-matrix.md`. Desde el 2026-10-18 la cara no autora `storagePlan`, filesystem ni cifrado de disco; un borrador importado con `storagePlan` no reabre el paso de disco. `executionStatus` de planes de disco permanece `not-executed`. TypeScript no inventa paquetes ni el perfil.
 - En `apps/web` con Vite, la CSP (`style-src 'self'`) exige CSS por `<link>` a `/forge-face.css` (plugin Vite); inyectar `<style>` inline deja la cara sin estilos.
 - La revisión auditada de arranque (UEFI / systemd-boot) vive en `docs/12-research/bootloader-review.md`.
 - La referencia visual histórica de la cara vive fuera del repo, en `/home/alexendros/Aplicaciones/Repertorio/archmaker_neubat.html` (no en Descargas); el nombre de ese archivo se conserva.
diff --git a/Cargo.lock b/Cargo.lock
index 1adfda8..56e8f81 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -51,6 +51,7 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 name = "archmaker"
 version = "0.1.0"
 dependencies = [
+ "archmaker-constitute",
  "archmaker-core",
  "archmaker-domain",
  "archmaker-hardware",
@@ -71,6 +72,15 @@ dependencies = [
  "sha2",
 ]
 
+[[package]]
+name = "archmaker-constitute"
+version = "0.1.0"
+dependencies = [
+ "hex",
+ "serde_json",
+ "sha2",
+]
+
 [[package]]
 name = "archmaker-core"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index f3d3dd0..f6b2825 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,6 +7,7 @@ members = [
   "crates/archmaker-core",
   "crates/archmaker-wasm",
   "crates/archmaker-hardware",
+  "crates/archmaker-constitute",
   "src-tauri",
 ]
 resolver = "2"
diff --git a/README.md b/README.md
index 16f6c3b..91eef09 100644
--- a/README.md
+++ b/README.md
@@ -6,10 +6,10 @@ Configurador local para diseñar, validar y exportar un perfil. Rust es la autor
 
 Tres capas distintas (detalle: [`docs/10-delivery/closure/f8-governance.md`](docs/10-delivery/closure/f8-governance.md)):
 
-| Capa                 | Estado                                                                                                                          |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| Baseline de código   | **passed** — tag `implementation-baseline-mvp5`; F0–F8 fusionados en `main`                                                     |
-| Aprobación funcional | **pending** — matriz F7 ejecutable; sin `RC_SHA_FUNCIONAL` ni aceptación independiente (`f7-candidate.md`)                      |
+| Capa                 | Estado                                                                                                                             |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| Baseline de código   | **passed** — tag `implementation-baseline-mvp5`; F0–F8 fusionados en `main`                                                        |
+| Aprobación funcional | **pending** — matriz F7 ejecutable; sin `RC_SHA_FUNCIONAL` ni aceptación independiente (`f7-candidate.md`)                         |
 | Release binaria      | **published** — [Neubat v0.1.0](https://github.com/Alexendros/archmaker/releases/tag/v0.1.0) AppImage x86_64; verificación parcial |
 
 - Código actual de `main` y el AppImage publicado son identidades distintas: el tip de `main`
@@ -23,9 +23,9 @@ Tres capas distintas (detalle: [`docs/10-delivery/closure/f8-governance.md`](doc
 - Diagramas Archify (Forge as-built): [`docs/02-architecture/diagrams/`](docs/02-architecture/diagrams/).
   Archify es herramienta de diagramación; no confundir con Forge.
 - Gate global (mecánico): **Clear** — todos los gates G0–G10 están `complete`. Autoridad: [`docs/00-governance/go-no-go.md`](docs/00-governance/go-no-go.md) y [`docs/10-delivery/gates.md`](docs/10-delivery/gates.md).
-- Veredicto de gobierno: **CONDITIONAL-CLEAR** hasta MVP-5 (sin runner). Autoriza el walking skeleton, los slices MVP-1..MVP-5 y el canal AppImage de MVP-6; runner, privilegios, ISO y Enterprise siguen bloqueados.
+- Veredicto de gobierno: **CONDITIONAL-CLEAR** hasta MVP-5, más el slice ISO-01 de imagen viva x86_64 UEFI. Autoriza el walking skeleton, los slices MVP-1..MVP-5 y el canal AppImage de MVP-6. Siguen bloqueados el runner de instalación, la escritura de discos, la shell arbitraria y Enterprise.
 - Baseline vigente: `implementation-baseline-mvp5` (commit anotado `b13c200…`; tags previos intactos). Remediación operativa: [`docs/10-delivery/remediation/`](docs/10-delivery/remediation/).
-- Alcance MVP-5 **accepted** y cerrado (MVP-5-01..05): [`docs/10-delivery/mvp5-scope.md`](docs/10-delivery/mvp5-scope.md). Hueco residual: [`mvp5-gap-spec.md`](docs/10-delivery/mvp5-gap-spec.md) (draft). Empaquetado MVP-6 **accepted solo AppImage** ([`mvp6-scope.md`](docs/10-delivery/mvp6-scope.md)); ISO sigue sin `accepted`.
+- Alcance MVP-5 **accepted** y cerrado (MVP-5-01..05): [`docs/10-delivery/mvp5-scope.md`](docs/10-delivery/mvp5-scope.md). Hueco residual: [`mvp5-gap-spec.md`](docs/10-delivery/mvp5-gap-spec.md) (draft). Empaquetado MVP-6 **accepted solo AppImage** ([`mvp6-scope.md`](docs/10-delivery/mvp6-scope.md)); imagen viva [`iso-scope.md`](docs/10-delivery/iso-scope.md) **accepted** (ISO-01). El target `archmaker-live-profile` está en el árbol; la cara no invoca `mkarchiso`.
 - Fuentes históricas: `reference/v5.1/`, conservadas por hash; walking skeleton en [`docs/10-delivery/walking-skeleton.md`](docs/10-delivery/walking-skeleton.md).
 - Rust: autoridad de dominio y casos de uso (nativo + WASM).
 - React: cara Forge; escritorio → `TauriCorePort` (`invoke` de `@tauri-apps/api/core`); navegador → `WasmCorePort`. `MockCorePort` solo con `?mock=1` en desarrollo.
diff --git a/apps/web/a11y-playwright.test.ts b/apps/web/a11y-playwright.test.ts
index 2aa36ae..0134f8f 100644
--- a/apps/web/a11y-playwright.test.ts
+++ b/apps/web/a11y-playwright.test.ts
@@ -117,7 +117,7 @@ test.describe("F6 viewports y foco", () => {
       await page.setViewportSize({ width, height: 800 });
       await page.goto(BASE_URL);
       await expect(
-        page.getByRole("heading", { name: /Disco y particiones/i }),
+        page.getByRole("heading", { name: /Sistema base/i }),
       ).toBeVisible({ timeout: 30_000 });
       // Rail y stepper coexisten; solo uno es visible por viewport (CSS).
       await expect(
diff --git a/apps/web/e2e-fidelity-helpers.ts b/apps/web/e2e-fidelity-helpers.ts
index e261095..31b1e8a 100644
--- a/apps/web/e2e-fidelity-helpers.ts
+++ b/apps/web/e2e-fidelity-helpers.ts
@@ -1,18 +1,15 @@
 /**
- * Helpers compartidos para el ejercicio E2E de cierre:
- * selección Forge → Generar → Exportar → SHA-256(archivo) == binaryDigest.
- * Fuera de alcance: imagen Arch, ISO, root, discos, pacstrap, instalación real.
+ * Helpers del recorrido Forge de cinco pasos:
+ * selección → Generar → Pedir imagen (error tipado mientras la constitución
+ * no está cableada).
  */
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
 import { expect, type Page } from "@playwright/test";
 
 /** Hostname del ejercicio de ejemplo (F3). */
 export const E2E_HOSTNAME = "arch-e2e-audit";
 
-/** Seis pasos del rail Forge (RAIL_STEPS). */
+/** Cinco pasos del rail Forge (RAIL_STEPS). */
 export const FORGE_RAIL_STEPS = [
-  "Disco y particiones",
   "Sistema base",
   "Entorno",
   "Apps",
@@ -25,12 +22,6 @@ export const FORGE_RAIL_STEPS = [
  * Cada fila debe poder ejercitarse o quedar cubierta por un test dedicado.
  */
 export const ESSENTIAL_CONTROLS = [
-  {
-    id: "rail-storage",
-    route: "rail",
-    step: "Disco y particiones",
-    control: "button",
-  },
   { id: "rail-base", route: "rail", step: "Sistema base", control: "button" },
   { id: "rail-env", route: "rail", step: "Entorno", control: "button" },
   { id: "rail-apps", route: "rail", step: "Apps", control: "button" },
@@ -60,12 +51,6 @@ export const ESSENTIAL_CONTROLS = [
     control: "Oscuro|Claro",
   },
   { id: "header-cmdk", route: "header", step: "*", control: "Ctrl+K" },
-  {
-    id: "nav-to-base",
-    route: "storage",
-    step: "Disco y particiones",
-    control: "Continuar → Sistema base",
-  },
   {
     id: "nav-to-env",
     route: "base",
@@ -97,16 +82,10 @@ export const ESSENTIAL_CONTROLS = [
     control: "hostname text",
   },
   {
-    id: "identity-encrypt",
-    route: "identity",
-    step: "Identidad y seguridad",
-    control: "Activar cifrado",
-  },
-  {
-    id: "review-export",
+    id: "review-image",
     route: "review",
     step: "Revisión",
-    control: "Exportar",
+    control: "Pedir imagen",
   },
   {
     id: "review-import",
@@ -116,30 +95,25 @@ export const ESSENTIAL_CONTROLS = [
   },
 ] as const;
 
-export function sha256FileHex(path: string): string {
-  return createHash("sha256").update(readFileSync(path)).digest("hex");
+/** Texto visible: sin disco, partición, tabla, ESP, LUKS, cifrado ni formateo. */
+export async function assertNoDiskVocabulary(page: Page): Promise<void> {
+  const body = await page.locator("body").innerText();
+  expect(body).not.toMatch(/\bdiscos?\b/i);
+  expect(body).not.toMatch(/partici[oó]n/i);
+  expect(body).not.toMatch(/\bGPT\b/);
+  expect(body).not.toMatch(/\bMBR\b/);
+  expect(body).not.toMatch(/\bESP\b/);
+  expect(body).not.toMatch(/\bLUKS\b/i);
+  expect(body).not.toMatch(/cifrado/i);
+  expect(body).not.toMatch(/formatear/i);
 }
 
-/** Declara storage mínimo (modo + acks) sin fingir detección. */
-export async function completeStorageDeclaration(page: Page): Promise<void> {
-  await page
-    .getByRole("radio", { name: /Disco nuevo o sin datos a conservar/i })
-    .click();
-  await page
-    .getByRole("checkbox", { name: /declaración de intención/i })
-    .check();
-}
-
-/** Recorrido razonable: storage → base Ext4 → GNOME → identidad. */
+/** Recorrido: base → GNOME → identidad. Sin disco ni cifrado. */
 export async function completeExampleSelection(page: Page): Promise<void> {
-  await completeStorageDeclaration(page);
-  await page
-    .getByRole("button", { name: /Continuar → Sistema base/i })
-    .click();
-
   await page.getByRole("radio", { name: /Linux Zen/i }).click();
-  await expect(page.getByRole("radio", { name: /systemd-boot/i })).toBeChecked();
-  await page.getByRole("radio", { name: /^Ext4$/i }).click();
+  await expect(
+    page.getByRole("radio", { name: /systemd-boot/i }),
+  ).toBeChecked();
 
   await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
   await expect(page.getByRole("radio", { name: /GNOME/i })).toBeChecked();
@@ -151,23 +125,17 @@ export async function completeExampleSelection(page: Page): Promise<void> {
 
   await page.getByRole("button", { name: /Continuar → Identidad/i }).click();
   await page.getByPlaceholder("mi-equipo").fill(E2E_HOSTNAME);
-  await page.getByRole("checkbox", { name: /Activar cifrado/i }).check();
 
   await page.getByRole("button", { name: /Continuar → Revisión/i }).click();
   await expect(page.getByRole("heading", { name: "Revisión" })).toBeVisible();
   await expect(page.getByText(`Hostname: ${E2E_HOSTNAME}`)).toBeVisible();
-  await expect(
-    page.getByText(/Cifrado: intención marcada \(no aplicada al disco\)/i),
-  ).toBeVisible();
 }
 
 /**
- * Generar + Exportar: comprueba SHA-256 del archivo == binaryDigest (toast)
- * y fidelidad hostname/cifrado en el JSON (F3).
+ * Generar deja el manifiesto listo. Pedir imagen llama a la operación tipada
+ * y no descarga un archivo: en este runtime no hay mkarchiso.
  */
-export async function generateExportAndAssertFidelity(
-  page: Page,
-): Promise<{ digest: string; filename: string }> {
+export async function generateAndAskForImage(page: Page): Promise<void> {
   await page.getByRole("button", { name: "Generar" }).click();
   await expect(page.getByRole("heading", { name: "Revisión" })).toBeVisible();
   await expect(page.locator("#toast-region")).toContainText(
@@ -175,33 +143,10 @@ export async function generateExportAndAssertFidelity(
     { timeout: 60_000 },
   );
 
-  const downloadPromise = page.waitForEvent("download");
-  await page.getByRole("button", { name: "Exportar" }).click();
-  const download = await downloadPromise;
-  const filename = download.suggestedFilename();
-  expect(filename).toMatch(/archmaker-profile-.*\.json/);
-
-  const path = await download.path();
-  expect(path).toBeTruthy();
-  const digest = sha256FileHex(path!);
-  expect(digest).toMatch(/^[0-9a-f]{64}$/);
-
-  const digestShort = digest.slice(0, 12);
+  await page.getByRole("button", { name: "Pedir imagen" }).click();
   await expect(page.locator("#toast-region")).toContainText(
-    new RegExp(`Descarga iniciada \\(${digestShort}`),
+    /constitution-mkarchiso-absent/,
     { timeout: 15_000 },
   );
-
-  const text = readFileSync(path!, "utf8");
-  expect(text).toContain("archmaker.face.hostname");
-  expect(text).toContain(E2E_HOSTNAME);
-  expect(text).toContain("archmaker.face.encrypt");
-  expect(text.toLowerCase()).not.toMatch(/cifrado aplicado|disk encrypted/);
-
-  // Paridad selección → export: arranque y filesystem del ejercicio.
-  expect(text).toMatch(/systemd-boot|archmaker\.boot\.systemd-boot/);
-  expect(text).toMatch(/ext4|archmaker\.filesystem\.ext4/i);
-  expect(text).toMatch(/zen|archmaker\.kernel\.zen/i);
-
-  return { digest, filename };
+  await expect(page.getByText(/Archivo guardado/i)).toHaveCount(0);
 }
diff --git a/apps/web/forge-helpers.playwright.test.ts b/apps/web/forge-helpers.playwright.test.ts
index a617676..85a5b3e 100644
--- a/apps/web/forge-helpers.playwright.test.ts
+++ b/apps/web/forge-helpers.playwright.test.ts
@@ -109,7 +109,7 @@ test.describe("draftForCore Prove-It", () => {
     });
   });
 
-  test("keeps hostname and encrypt; lists face exclusions", () => {
+  test("keeps hostname, drops encrypt, lists face exclusions", () => {
     let draft = emptyDraft();
     draft = chooseSingle(draft, STEP_IDS.intent, "archmaker.intent.desarrollo");
     draft = setText(draft, STEP_IDS.hostname, "arch-forge");
@@ -134,7 +134,9 @@ test.describe("draftForCore Prove-It", () => {
 
     const forCore = draftForCore(draft);
     expect(textValue(forCore, STEP_IDS.hostname)).toBe("arch-forge");
-    expect(boolValue(forCore, STEP_IDS.encrypt)).toBe(true);
+    expect(forCore.selections.some((s) => s.stepId === STEP_IDS.encrypt)).toBe(
+      false,
+    );
     expect(forCore.selections.some((s) => s.stepId === STEP_IDS.intent)).toBe(
       false,
     );
@@ -218,9 +220,9 @@ test.describe("storage-plan-face H01/H02", () => {
     expect(plan?.planStatus).toBe("verification-pending");
     expect(plan?.planStatus).not.toBe("certifiable");
 
-    const draft = withFaceV2Fields(emptyDraft(), intent);
+    const draft = withFaceV2Fields(emptyDraft());
     expect(draft.schemaVersion).toBe("2");
-    expect(draft.storagePlan?.mode).toBe("new-disk");
+    expect(draft.storagePlan).toBeUndefined();
     expect(draft.verification?.executionStatus).toBe("not-executed");
     expect(draft.verification?.planValidationStatus).toBe("not-validated");
   });
@@ -237,18 +239,21 @@ test.describe("storage-plan-face H01/H02", () => {
     expect(plan?.planStatus).toBe("not-certifiable");
   });
 
-  test("H01: storagePlan sobrevive withFaceV2Fields → draftForCore", async () => {
+  test("H01: el plan de disco no llega a draftForCore", async () => {
     const { withFaceV2Fields } = await import("./src/storage-plan-face.js");
-    const intent = {
-      mode: "new-disk" as const,
+    const { storagePlanFromIntent } =
+      await import("./src/storage-plan-face.js");
+    const seeded = emptyDraft();
+    seeded.storagePlan = storagePlanFromIntent({
+      mode: "new-disk",
       intentAcknowledged: true,
       lossRiskAcknowledged: false,
-      uiState: "proposed" as const,
-    };
-    const projected = withFaceV2Fields(emptyDraft(), intent);
+      uiState: "proposed",
+    });
+    const projected = withFaceV2Fields(seeded);
     const forCore = draftForCore(projected);
-    expect(forCore.storagePlan?.mode).toBe("new-disk");
-    expect(forCore.storagePlan?.intentAcknowledged).toBe(true);
+    expect(forCore.storagePlan).toBeUndefined();
+    expect(forCore.encryptionPolicy).toBeUndefined();
     expect(forCore.verification?.planValidationStatus).toBe("not-validated");
     expect(forCore.verification?.executionStatus).toBe("not-executed");
   });
diff --git a/apps/web/mock-flow.playwright.test.ts b/apps/web/mock-flow.playwright.test.ts
index 4517fc4..25ca401 100644
--- a/apps/web/mock-flow.playwright.test.ts
+++ b/apps/web/mock-flow.playwright.test.ts
@@ -2,9 +2,9 @@ import { test, expect } from "@playwright/test";
 import {
   ESSENTIAL_CONTROLS,
   FORGE_RAIL_STEPS,
+  assertNoDiskVocabulary,
   completeExampleSelection,
-  completeStorageDeclaration,
-  generateExportAndAssertFidelity,
+  generateAndAskForImage,
 } from "./e2e-fidelity-helpers.js";
 
 const BASE_URL = process.env.BASE_URL || "http://localhost:5173/?mock=1";
@@ -13,15 +13,15 @@ test.describe("Forge face — rutas del plan", () => {
   test.beforeEach(async ({ page }) => {
     await page.goto(BASE_URL);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible();
   });
 
-  test("inventario: seis pasos Forge y controles esenciales en DOM", async ({
+  test("inventario: cinco pasos Forge y controles esenciales en DOM", async ({
     page,
   }) => {
-    expect(FORGE_RAIL_STEPS).toHaveLength(6);
-    expect(ESSENTIAL_CONTROLS.length).toBeGreaterThanOrEqual(18);
+    expect(FORGE_RAIL_STEPS).toHaveLength(5);
+    expect(ESSENTIAL_CONTROLS.length).toBeGreaterThanOrEqual(12);
     const rail = page.getByRole("navigation", {
       name: /Pasos del configurador$/i,
     });
@@ -41,27 +41,34 @@ test.describe("Forge face — rutas del plan", () => {
     await expect(page.getByRole("button", { name: "Glosario" })).toBeVisible();
     await expect(page.getByRole("button", { name: "Ctrl+K" })).toBeVisible();
     await expect(
-      page.getByRole("button", { name: /Continuar → Sistema base/i }),
+      page.getByRole("button", { name: /Continuar → Entorno/i }),
     ).toBeVisible();
+    await assertNoDiskVocabulary(page);
+    for (const next of [
+      /Continuar → Entorno/i,
+      /Continuar → Apps/i,
+      /Continuar → Identidad/i,
+      /Continuar → Revisión/i,
+    ]) {
+      await page.getByRole("button", { name: next }).click();
+      await assertNoDiskVocabulary(page);
+    }
     await expect(page.locator(".forge-title")).toContainText("ArchMaker Forge");
     await expect(page.locator("[data-app-version]")).toBeVisible();
     await expect(page.locator("body")).not.toContainText("v4.1");
   });
 
-  test("F3 ejercicio: selección → Generar → Exportar → SHA-256 == binaryDigest", async ({
+  test("F3 ejercicio: selección → Generar → pedir imagen (constitución cerrada)", async ({
     page,
   }) => {
     test.setTimeout(90_000);
     await completeExampleSelection(page);
-    const { digest } = await generateExportAndAssertFidelity(page);
-    expect(digest).toHaveLength(64);
+    await generateAndAskForImage(page);
   });
 
-  test("arranque: Disco y particiones; sin paso Intención", async ({
-    page,
-  }) => {
+  test("arranque: Sistema base; sin paso Intención", async ({ page }) => {
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible();
     await expect(
       page.getByRole("navigation", { name: /Pasos/i }).first(),
@@ -74,29 +81,14 @@ test.describe("Forge face — rutas del plan", () => {
           name: /^Intención$/i,
         }),
     ).toHaveCount(0);
-    await expect(page.getByText(/no modifica discos/i).first()).toBeVisible();
-  });
-
-  test("storage: modo new-disk y acknowledgements", async ({ page }) => {
-    await completeStorageDeclaration(page);
     await expect(
-      page.getByRole("radio", {
-        name: /Disco nuevo o sin datos a conservar/i,
-      }),
-    ).toBeChecked();
-    await expect(
-      page.getByRole("checkbox", { name: /declaración de intención/i }),
-    ).toBeChecked();
+      page.getByRole("button", { name: /Pedir imagen/i }),
+    ).toHaveCount(0);
   });
 
-  test("sistema base: boot y filesystem exclusivos", async ({ page }) => {
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
-
+  test("sistema base: bootloaders exclusivos", async ({ page }) => {
     const systemd = page.getByRole("radio", { name: /systemd-boot/i });
     await expect(systemd).toBeChecked();
-    await expect(page.getByRole("radio", { name: /^Btrfs$/i })).toBeChecked();
 
     await page.getByRole("radio", { name: /^GRUB$/i }).click();
     await expect(page.getByRole("radio", { name: /^GRUB$/i })).toBeChecked();
@@ -107,12 +99,6 @@ test.describe("Forge face — rutas del plan", () => {
     await systemd.click();
     await expect(systemd).toBeChecked();
 
-    await page.getByRole("radio", { name: /^Ext4$/i }).click();
-    await expect(page.getByRole("radio", { name: /^Ext4$/i })).toBeChecked();
-    await expect(
-      page.getByRole("radio", { name: /^Btrfs$/i }),
-    ).not.toBeChecked();
-
     await page.getByRole("radio", { name: /Linux Zen/i }).click();
     await expect(page.getByRole("radio", { name: /Linux Zen/i })).toBeChecked();
   });
@@ -120,9 +106,6 @@ test.describe("Forge face — rutas del plan", () => {
   test("entorno: catálogo completo con Hyprland; GNOME marcado", async ({
     page,
   }) => {
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
 
     await expect(page.getByRole("radio", { name: /GNOME/i })).toBeChecked();
@@ -133,9 +116,6 @@ test.describe("Forge face — rutas del plan", () => {
   });
 
   test("apps: capas, toggle y ficha de paquete", async ({ page }) => {
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
     await page.getByRole("button", { name: /Continuar → Apps/i }).click();
 
@@ -166,25 +146,19 @@ test.describe("Forge face — rutas del plan", () => {
     await expect(zen).toBeChecked();
   });
 
-  test("identidad: hostname y cifrado se guardan en la cara", async ({
-    page,
-  }) => {
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
+  test("identidad: hostname se guarda en la cara", async ({ page }) => {
     await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
     await page.getByRole("button", { name: /Continuar → Apps/i }).click();
     await page.getByRole("button", { name: /Continuar → Identidad/i }).click();
 
     await page.getByPlaceholder("mi-equipo").fill("arch-forge");
     await expect(page.getByPlaceholder("mi-equipo")).toHaveValue("arch-forge");
-    await page.getByRole("checkbox", { name: /Activar cifrado/i }).check();
     await expect(
       page.getByRole("checkbox", { name: /Activar cifrado/i }),
-    ).toBeChecked();
+    ).toHaveCount(0);
   });
 
-  test("revisión: Generar valida y Exportar entrega archivo", async ({
+  test("revisión: Generar valida y pedir imagen no guarda archivo", async ({
     page,
   }) => {
     await page.getByRole("button", { name: "Generar" }).click();
@@ -193,12 +167,9 @@ test.describe("Forge face — rutas del plan", () => {
       /Manifest listo|Validación/i,
     );
     await expect(page.getByText(/Arranque systemd-boot/i)).toBeVisible();
-    const downloadPromise = page.waitForEvent("download");
-    await page.getByRole("button", { name: "Exportar" }).click();
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toMatch(/archmaker-profile-.*\.json/);
+    await page.getByRole("button", { name: "Pedir imagen" }).click();
     await expect(page.locator("#toast-region")).toContainText(
-      /Descarga iniciada/i,
+      /constitution-mkarchiso-absent/,
     );
   });
 
@@ -228,7 +199,7 @@ test.describe("Forge face — rutas del plan", () => {
   test("cabecera: glosario, tema y paleta Ctrl+K", async ({ page }) => {
     await page.getByRole("button", { name: "Glosario" }).click();
     await expect(page.getByRole("heading", { name: "Glosario" })).toBeVisible();
-    await expect(page.getByText(/Disco y particiones/i).first()).toBeVisible();
+    await expect(page.getByText(/Sistema base/i).first()).toBeVisible();
     await page.getByRole("button", { name: "Cerrar glosario" }).click();
 
     await page.getByRole("button", { name: "Oscuro" }).click();
@@ -249,9 +220,6 @@ test.describe("Forge face — rutas del plan", () => {
     await page.keyboard.press("Escape");
     await expect(page.getByRole("dialog")).toHaveCount(0);
 
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
     await page.getByRole("button", { name: /Continuar → Apps/i }).click();
     await page.getByRole("button", { name: /Firefox/i }).click();
@@ -300,12 +268,11 @@ test.describe("Forge face — rutas del plan", () => {
     await expect(page.getByRole("heading", { name: "Revisión" })).toBeVisible({
       timeout: 60_000,
     });
-    const downloadPromise = page.waitForEvent("download");
-    await page.getByRole("button", { name: "Exportar" }).click();
-    const download = await downloadPromise;
-    const path = await download.path();
-    expect(path).toBeTruthy();
-    await page.locator('input[type="file"]').setInputFiles(path!);
+    await page.locator('input[type="file"]').setInputFiles({
+      name: "no-es-perfil.json",
+      mimeType: "application/json",
+      buffer: Buffer.from('{"ok":true}'),
+    });
     await expect(page.locator(".forge-toast")).toContainText("AM-MIG-001", {
       timeout: 15_000,
     });
@@ -347,9 +314,6 @@ test.describe("Forge face — rutas del plan", () => {
   });
 
   test("toast Deshacer restaura el paquete", async ({ page }) => {
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
     await page.getByRole("button", { name: /Continuar → Apps/i }).click();
 
@@ -362,9 +326,6 @@ test.describe("Forge face — rutas del plan", () => {
   });
 
   test("entorno: DEs y WMs visibles", async ({ page }) => {
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await page.getByRole("button", { name: /Continuar → Entorno/i }).click();
 
     for (const name of [
@@ -382,15 +343,15 @@ test.describe("Forge face — rutas del plan", () => {
     }
   });
 
-  test("rail: navegar a revisión y volver a disco", async ({ page }) => {
+  test("rail: navegar a revisión y volver a sistema base", async ({ page }) => {
     const rail = page.getByRole("navigation", {
       name: /Pasos del configurador$/i,
     });
     await rail.getByRole("button", { name: /Revisión/i }).click();
     await expect(page.getByRole("heading", { name: "Revisión" })).toBeVisible();
-    await rail.getByRole("button", { name: /Disco y particiones/i }).click();
+    await rail.getByRole("button", { name: /Sistema base/i }).click();
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible();
   });
 
@@ -399,15 +360,12 @@ test.describe("Forge face — rutas del plan", () => {
       page.getByText("Resumen de configuración").first(),
     ).toBeVisible();
     await expect(page.getByText("Actividades")).toHaveCount(0);
-    await expect(page.locator("[data-storage-ui-state]")).toBeVisible();
+    await expect(page.locator("[data-storage-ui-state]")).toHaveCount(0);
   });
 
   test("progreso: atributo data-step-progress en rail", async ({ page }) => {
     const current = page.locator('#step-rail [data-step-progress="current"]');
     await expect(current).toHaveCount(1);
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await expect(
       page.locator('#step-rail [data-step-progress="current"]'),
     ).toContainText(/Sistema base/i);
diff --git a/apps/web/product-acceptance.playwright.test.ts b/apps/web/product-acceptance.playwright.test.ts
index 2350fef..12ed0a2 100644
--- a/apps/web/product-acceptance.playwright.test.ts
+++ b/apps/web/product-acceptance.playwright.test.ts
@@ -144,13 +144,13 @@ test.describe("P5 product-acceptance — integridad y recorrido", () => {
     expect(outcome.status).toBe("error");
   });
 
-  test("teclado: recorrido esencial Disco → Continuar → Generar", async ({
+  test("teclado: recorrido esencial Continuar → Generar", async ({
     page,
   }) => {
     test.setTimeout(90_000);
     await page.goto(MOCK_URL);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 30_000 });
 
     // Skip link / foco inicial
@@ -160,16 +160,13 @@ test.describe("P5 product-acceptance — integridad y recorrido", () => {
 
     // Continuar con teclado (foco + Enter en el CTA)
     const continueBtn = page.getByRole("button", {
-      name: /Continuar → Sistema base/i,
+      name: /Continuar → Entorno/i,
     });
     await continueBtn.focus();
     await page.keyboard.press("Enter");
     await expect(
-      page.getByRole("heading", { name: "Sistema base" }),
+      page.getByRole("heading", { name: /Entorno/i }),
     ).toBeVisible({ timeout: 15_000 });
-    await expect(
-      page.getByRole("radio", { name: /systemd-boot/i }),
-    ).toBeChecked();
 
     // Generar (cabecera) con teclado
     const generate = page.getByRole("button", { name: "Generar" });
diff --git a/apps/web/responsive-layout.playwright.test.ts b/apps/web/responsive-layout.playwright.test.ts
index e39507b..bdc4ac4 100644
--- a/apps/web/responsive-layout.playwright.test.ts
+++ b/apps/web/responsive-layout.playwright.test.ts
@@ -32,7 +32,7 @@ test.describe("Forge — responsive-layout", () => {
       await page.setViewportSize({ width: vp.width, height: vp.height });
       await page.goto(BASE_URL);
       await expect(
-        page.getByRole("heading", { name: /Disco y particiones/i }),
+        page.getByRole("heading", { name: /Sistema base/i }),
       ).toBeVisible({ timeout: 30_000 });
 
       const zoom = await page.evaluate(() => {
@@ -70,10 +70,10 @@ test.describe("Forge — responsive-layout", () => {
       await page.keyboard.press("Escape");
 
       await page
-        .getByRole("button", { name: /Continuar → Sistema base/i })
+        .getByRole("button", { name: /Continuar → Entorno/i })
         .click();
       await expect(
-        page.getByRole("heading", { name: "Sistema base" }),
+        page.getByRole("heading", { name: /Entorno/i }),
       ).toBeVisible();
     });
   }
@@ -84,7 +84,7 @@ test.describe("Forge — responsive-layout", () => {
     await page.setViewportSize({ width: 1440, height: 900 });
     await page.goto(BASE_URL);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible();
 
     const css = await layoutCssSource(page);
diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index 40baf49..86ec3ce 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -30,14 +30,6 @@ import {
   type PersistResult,
   type PersistStatus,
 } from "./draft-persistence.js";
-import {
-  DeliveryError,
-  deliverArtifact,
-  destinationTokenFor,
-  exportFilename,
-  exportStatusMessage,
-} from "./export-delivery.js";
-import { isPreparedCurrent } from "./export-generation.js";
 import { PRODUCT_WINDOW_TITLE } from "./build-meta.js";
 import { ForgeAside } from "./ForgeAside.js";
 import { ForgeHeader } from "./ForgeHeader.js";
@@ -48,9 +40,7 @@ import { ImportReportDialog } from "./ImportReportDialog.js";
 import { PackageDialog } from "./PackageDialog.js";
 import {
   appIds,
-  boolValue,
   chooseSingle,
-  setBool,
   setText,
   singleId,
   textValue,
@@ -59,7 +49,6 @@ import {
 import {
   BOOTLOADERS,
   ENVIRONMENTS,
-  FILESYSTEMS,
   INITIAL_APP_OPTION_IDS,
   INITIAL_SINGLE,
   KERNELS,
@@ -72,17 +61,7 @@ import {
   type FacePackage,
 } from "./forge-face.js";
 import { allStepProgress } from "./step-progress.js";
-import {
-  INITIAL_STORAGE_INTENT,
-  labelStorageMode,
-  type StorageIntent,
-  type StorageMode,
-} from "./storage-intent.js";
-import {
-  intentFromStoragePlan,
-  uiStateForIntent,
-  withFaceV2Fields,
-} from "./storage-plan-face.js";
+import { withFaceV2Fields } from "./storage-plan-face.js";
 import {
   mergeFaceOptionsFromCatalog,
   parseCatalogView,
@@ -166,10 +145,6 @@ function withInitialSelections(draft: Draft): Draft {
         stepId: STEP_IDS.boot,
         value: { kind: "single", optionId: INITIAL_SINGLE.boot },
       },
-      {
-        stepId: STEP_IDS.filesystem,
-        value: { kind: "single", optionId: INITIAL_SINGLE.filesystem },
-      },
       {
         stepId: STEP_IDS.compositor,
         value: { kind: "single", optionId: INITIAL_SINGLE.compositor },
@@ -196,7 +171,6 @@ export function App({ port, portKind }: Props) {
   const [step, setStep] = useState(0);
   const [visited, setVisited] = useState<Set<number>>(() => new Set([0]));
   const [invalid, setInvalid] = useState<Set<number>>(() => new Set());
-  const [storage, setStorage] = useState<StorageIntent>(INITIAL_STORAGE_INTENT);
   const [dark, setDark] = useState(false);
   const [toast, setToast] = useState<ToastState>(null);
   const [pkgModal, setPkgModal] = useState<FacePackage | null>(null);
@@ -233,13 +207,10 @@ export function App({ port, portKind }: Props) {
   const bootId =
     singleId(draft, STEP_IDS.boot) ?? "archmaker.boot.systemd-boot";
   const kernelId = singleId(draft, STEP_IDS.kernel) ?? "archmaker.kernel.linux";
-  const fsId =
-    singleId(draft, STEP_IDS.filesystem) ?? "archmaker.filesystem.btrfs";
   const envId =
     singleId(draft, STEP_IDS.compositor) ?? "archmaker.compositor.gnome";
   const selectedApps = useMemo(() => new Set(appIds(draft)), [draft]);
   const hostname = textValue(draft, STEP_IDS.hostname);
-  const encrypt = boolValue(draft, STEP_IDS.encrypt);
 
   const kernelOptions = useMemo(
     () => mergeFaceOptionsFromCatalog(catalogView, STEP_IDS.kernel, KERNELS),
@@ -249,19 +220,9 @@ export function App({ port, portKind }: Props) {
     () => mergeFaceOptionsFromCatalog(catalogView, STEP_IDS.boot, BOOTLOADERS),
     [catalogView],
   );
-  const filesystemOptions = useMemo(
-    () =>
-      mergeFaceOptionsFromCatalog(
-        catalogView,
-        STEP_IDS.filesystem,
-        FILESYSTEMS,
-      ),
-    [catalogView],
-  );
   const env = ENVIRONMENTS.find((e) => e.optionId === envId);
   const kernel = kernelOptions.find((k) => k.optionId === kernelId);
   const boot = bootOptions.find((b) => b.optionId === bootId);
-  const filesystem = filesystemOptions.find((f) => f.optionId === fsId);
   const envs = allEnvironments();
   const layers = allLayers();
   const stepProgress = useMemo(
@@ -270,11 +231,10 @@ export function App({ port, portKind }: Props) {
         current: step,
         visited,
         invalid,
-        storage,
         hasDefaults: Boolean(draft),
         reviewReady: validated && Boolean(manifest),
       }),
-    [step, visited, invalid, storage, draft, validated, manifest],
+    [step, visited, invalid, draft, validated, manifest],
   );
 
   const selectedPackages = useMemo(() => {
@@ -321,17 +281,13 @@ export function App({ port, portKind }: Props) {
   }, []);
 
   const applyDraft = useCallback(
-    (next: Draft, nextStorage?: StorageIntent) => {
-      const intent =
-        nextStorage ??
-        (next.storagePlan ? intentFromStoragePlan(next.storagePlan) : storage);
-      const projected = withFaceV2Fields(next, intent);
+    (next: Draft) => {
+      const projected = withFaceV2Fields(next);
       setDraft(projected);
-      setStorage({ ...intent, uiState: uiStateForIntent(intent) });
       invalidateDerived();
       void persistDraftLocal(projected).then(handlePersistResult);
     },
-    [handlePersistResult, invalidateDerived, storage],
+    [handlePersistResult, invalidateDerived],
   );
 
   useEffect(() => {
@@ -365,8 +321,9 @@ export function App({ port, portKind }: Props) {
         });
         if (cancelled) return;
         if (opened.ok) {
-          setDraft(opened.value);
-          setStorage(intentFromStoragePlan(opened.value.storagePlan));
+          const recovered = withFaceV2Fields(opened.value);
+          setDraft(recovered);
+          void persistDraftLocal(recovered).then(handlePersistResult);
           setReady(true);
           announce("status", "Perfil recuperado.");
           return;
@@ -388,10 +345,7 @@ export function App({ port, portKind }: Props) {
         fail(res.error, "Crear draft");
         return;
       }
-      let next = withFaceV2Fields(
-        withInitialSelections(res.value),
-        INITIAL_STORAGE_INTENT,
-      );
+      let next = withFaceV2Fields(withInitialSelections(res.value));
       const saved = await port.saveDraft({
         draft: next,
         expectedRevision: next.revision,
@@ -403,9 +357,8 @@ export function App({ port, portKind }: Props) {
         fail(saved.error, "Guardar selecciones iniciales");
         return;
       }
-      next = saved.value;
+      next = withFaceV2Fields(saved.value);
       setDraft(next);
-      setStorage(intentFromStoragePlan(next.storagePlan));
       void persistDraftLocal(next).then(handlePersistResult);
       setReady(true);
       announce("status", `Draft listo (${portKind}). Arranque: systemd-boot.`);
@@ -539,21 +492,16 @@ export function App({ port, portKind }: Props) {
     try {
       const prepared = await prepareExport();
       if (prepared.ok) {
-        // El manifiesto de catálogo no certifica el plan de almacenamiento (H02).
         setInvalid((prev) => {
           const copy = new Set(prev);
           copy.delete(RAIL_STEPS.length - 1);
           return copy;
         });
         const exclusions = draft ? listFaceExclusions(draft).length : 0;
-        const storageNote =
-          storage.mode !== null && storage.uiState !== "validated"
-            ? " Plan de disco: declarado/propuesto, no validado."
-            : "";
         showToast(
           exclusions > 0
-            ? `Manifest listo con ${exclusions} exclusión(es) de cara.${storageNote}`
-            : `Validación sin bloqueos. Manifest listo.${storageNote}`,
+            ? `Manifest listo con ${exclusions} exclusión(es) de cara.`
+            : "Validación sin bloqueos. Manifest listo.",
         );
       } else if (prepared.reason === "draft-missing") {
         // requireDraft already announced; keep the user on revisión with status.
@@ -566,67 +514,13 @@ export function App({ port, portKind }: Props) {
 
   async function onForge(): Promise<void> {
     if (busy) return;
-    const d = requireDraft();
-    if (!d) return;
     setBusy(true);
     try {
-      let man = manifest;
-      const gate = {
-        generation: generationRef.current,
-        preparedGeneration: preparedGenerationRef.current,
-      };
-      if (!man || !isPreparedCurrent(gate)) {
-        const prepared = await prepareExport();
-        if (!prepared.ok) return;
-        man = prepared.manifest;
-      }
-      if (
-        !isPreparedCurrent({
-          generation: generationRef.current,
-          preparedGeneration: preparedGenerationRef.current,
-        })
-      ) {
-        announce("alert", "La configuración cambió; vuelve a generar.");
-        return;
-      }
-      const token = destinationTokenFor(d.id);
-      const res = await port.exportArtifact({
-        manifest: man,
-        targetRef: exportTarget("archmaker-profile"),
-        destination: { token },
-      });
-      if (!res.ok) {
-        fail(res.error, "Exportar");
-        return;
-      }
-      if (
-        !isPreparedCurrent({
-          generation: generationRef.current,
-          preparedGeneration: preparedGenerationRef.current,
-        })
-      ) {
-        announce(
-          "alert",
-          "Resultado de exportación descartado (edición concurrente).",
-        );
-        return;
-      }
-      try {
-        const name = exportFilename(token, res.value.targetRef.id);
-        // Web: download-started. Escritorio F5: file-saved tras diálogo acotado.
-        const outcome = await deliverArtifact(res.value, name);
-        if (outcome.kind === "cancelled") {
-          announce("status", "Guardado cancelado.");
-          return;
-        }
-        showToast(exportStatusMessage(outcome));
-      } catch (err) {
-        const message =
-          err instanceof DeliveryError
-            ? err.message
-            : "No se pudo entregar el archivo.";
-        announce("alert", message);
-      }
+      const result = await port.requestLiveImage();
+      const code = result.ok ? "constitution-unexpected" : result.error.code;
+      const message = `Constitución no disponible (${code}).`;
+      announce("alert", message);
+      showToast(message);
     } finally {
       setBusy(false);
     }
@@ -775,26 +669,6 @@ export function App({ port, portKind }: Props) {
     goToStep(step + delta);
   }
 
-  function patchStorage(patch: Partial<StorageIntent>): void {
-    const d = draft;
-    if (!d) return;
-    const next: StorageIntent = {
-      ...storage,
-      ...patch,
-    };
-    next.uiState = uiStateForIntent(next);
-    setInvalid((prev) => new Set(prev).add(RAIL_STEPS.length - 1));
-    applyDraft(d, next);
-  }
-
-  function pickStorageMode(mode: StorageMode): void {
-    patchStorage({
-      mode,
-      lossRiskAcknowledged:
-        mode === "replace-disk" ? storage.lossRiskAcknowledged : false,
-    });
-  }
-
   return (
     <>
       <a className="skip-link" href="#main">
@@ -840,105 +714,13 @@ export function App({ port, portKind }: Props) {
           {!ready && !bootError ? <p role="status">Preparando draft…</p> : null}
 
           {ready && !bootError && step === 0 ? (
-            <section aria-labelledby="storage-h">
-              <h1 id="storage-h">Disco y particiones</h1>
-              <p className="forge-lead">
-                Declara el modo de instalación. No hay detección en esta entrega
-                web; el perfil no modifica discos.
-              </p>
-              <div className="forge-callout forge-callout-info" role="status">
-                Esta fase prepara un perfil y no modifica discos.
-              </div>
-              <div
-                className="forge-grid-2"
-                role="radiogroup"
-                aria-label="Modo de disco"
-              >
-                {(
-                  [
-                    {
-                      mode: "new-disk" as const,
-                      title: "Disco nuevo o sin datos a conservar",
-                      description:
-                        "Declaración del usuario. No se deduce de un sondeo.",
-                    },
-                    {
-                      mode: "replace-disk" as const,
-                      title: "Reemplazo completo",
-                      description:
-                        "Se perderán los datos del destino. Requiere confirmación.",
-                    },
-                  ] as const
-                ).map((opt) => {
-                  const selected = storage.mode === opt.mode;
-                  return (
-                    <button
-                      key={opt.mode}
-                      type="button"
-                      className={`forge-card${selected ? " is-selected" : ""}`}
-                      role="radio"
-                      aria-checked={selected}
-                      data-storage-mode={opt.mode}
-                      onClick={() => pickStorageMode(opt.mode)}
-                    >
-                      <span className="forge-card-title">{opt.title}</span>
-                      <span className="forge-card-desc">{opt.description}</span>
-                    </button>
-                  );
-                })}
-              </div>
-              <div className="forge-stack forge-narrow">
-                <label className="forge-check">
-                  <input
-                    type="checkbox"
-                    checked={storage.intentAcknowledged}
-                    onChange={(e) =>
-                      patchStorage({ intentAcknowledged: e.target.checked })
-                    }
-                  />
-                  Confirmo que esta es una declaración de intención para el
-                  perfil (no una escritura en disco).
-                </label>
-                {storage.mode === "replace-disk" ? (
-                  <label className="forge-check">
-                    <input
-                      type="checkbox"
-                      checked={storage.lossRiskAcknowledged}
-                      onChange={(e) =>
-                        patchStorage({
-                          lossRiskAcknowledged: e.target.checked,
-                        })
-                      }
-                    />
-                    Entiendo el riesgo de pérdida total en un reemplazo.
-                  </label>
-                ) : null}
-                <p className="forge-muted" role="status">
-                  Modo: {labelStorageMode(storage.mode)}. Estado:{" "}
-                  {storage.uiState}. No hay botón Formatear en esta entrega.
-                </p>
-              </div>
-              <div className="forge-nav-row forge-nav-end">
-                <button
-                  type="button"
-                  className="forge-btn-primary"
-                  onClick={() => nav(1)}
-                >
-                  Continuar → Sistema base
-                </button>
-              </div>
-            </section>
-          ) : null}
-
-          {ready && !bootError && step === 1 ? (
             <section aria-labelledby="base-h">
-              <h2 id="base-h">Sistema base</h2>
+              <h1 id="base-h">Sistema base</h1>
               <p className="forge-lead">
-                Elige kernel, arranque y sistema de archivos. UKI no es un
-                gestor de arranque aparte.
+                Elige kernel y arranque. UKI no es un gestor de arranque aparte.
               </p>
               <div className="forge-stack">
-                <h3 className="forge-section-label">Kernel</h3>
+                <h2 className="forge-section-label">Kernel</h2>
                 <div
                   role="radiogroup"
                   aria-label="Kernel"
@@ -1008,32 +790,6 @@ export function App({ port, portKind }: Props) {
                     })}
                   </div>
                 </fieldset>
-                <fieldset className="forge-fieldset">
-                  <legend>Filesystem</legend>
-                  <div
-                    role="radiogroup"
-                    aria-label="Filesystem"
-                    className="forge-radio-row"
-                  >
-                    {filesystemOptions.map((f) => {
-                      const selected = fsId === f.optionId;
-                      return (
-                        <label key={f.optionId} className="forge-radio-label">
-                          <input
-                            type="radio"
-                            name="fs"
-                            checked={selected}
-                            onChange={() =>
-                              pickSingle(STEP_IDS.filesystem, f.optionId)
-                            }
-                            data-option-id={f.optionId}
-                          />
-                          {f.title}
-                        </label>
-                      );
-                    })}
-                  </div>
-                </fieldset>
               </div>
               <div className="forge-nav-row">
                 <button
@@ -1054,7 +810,7 @@ export function App({ port, portKind }: Props) {
             </section>
           ) : null}
 
-          {ready && !bootError && step === 2 ? (
+          {ready && !bootError && step === 1 ? (
             <section aria-labelledby="env-h">
               <div className="forge-heading-row">
                 <h2 id="env-h">Entorno gráfico</h2>
@@ -1127,7 +883,7 @@ export function App({ port, portKind }: Props) {
             </section>
           ) : null}
 
-          {ready && !bootError && step === 3 ? (
+          {ready && !bootError && step === 2 ? (
             <section aria-labelledby="apps-h">
               <h2 id="apps-h">Apps y paquetes</h2>
               <p className="forge-lead">
@@ -1218,7 +974,7 @@ export function App({ port, portKind }: Props) {
             </section>
           ) : null}
 
-          {ready && !bootError && step === 4 ? (
+          {ready && !bootError && step === 3 ? (
             <section aria-labelledby="id-h">
               <h2 id="id-h">Identidad y seguridad</h2>
               <div className="forge-stack forge-narrow">
@@ -1234,29 +990,6 @@ export function App({ port, portKind }: Props) {
                     }}
                   />
                 </label>
-                <div className="forge-info-card">
-                  <strong>Protege el disco (cifrado)</strong>
-                  <p className="forge-muted">
-                    Solo intención en el perfil exportado. Esta cara no cifra el
-                    disco.
-                  </p>
-                  <label className="forge-check">
-                    <input
-                      type="checkbox"
-                      role="checkbox"
-                      checked={encrypt}
-                      aria-checked={encrypt}
-                      onChange={(e) => {
-                        const d = requireDraft();
-                        if (!d) return;
-                        applyDraft(
-                          setBool(d, STEP_IDS.encrypt, e.target.checked),
-                        );
-                      }}
-                    />
-                    Activar cifrado
-                  </label>
-                </div>
               </div>
               <div className="forge-nav-row">
                 <button
@@ -1277,16 +1010,14 @@ export function App({ port, portKind }: Props) {
             </section>
           ) : null}
 
-          {ready && !bootError && step === 5 ? (
+          {ready && !bootError && step === 4 ? (
             <section aria-labelledby="review-h">
               <h2 id="review-h">Revisión</h2>
               <div className="forge-callout forge-callout-info">
                 <strong>Listo para forjar</strong>
                 <p>
-                  Disco {labelStorageMode(storage.mode)} · Kernel{" "}
-                  {kernel?.title ?? "—"} · Arranque {boot?.title ?? "—"} ·{" "}
-                  {filesystem?.title ?? "—"} · {selectedApps.size} apps ·{" "}
-                  {env?.title ?? "—"}
+                  Kernel {kernel?.title ?? "—"} · Arranque {boot?.title ?? "—"}{" "}
+                  · {selectedApps.size} apps · {env?.title ?? "—"}
                 </p>
                 {!validated ? (
                   <p role="status">Pendiente de validar.</p>
@@ -1301,21 +1032,7 @@ export function App({ port, portKind }: Props) {
                     (intención o no verificada) no entran al perfil sellado.
                   </p>
                 ) : null}
-                {draft?.storagePlan ? (
-                  <p role="status">
-                    Plan de disco: {draft.storagePlan.planStatus} (estado UI{" "}
-                    {storage.uiState}). La generación del manifiesto no valida
-                    el plan.
-                  </p>
-                ) : (
-                  <p role="status">Plan de disco: sin declarar.</p>
-                )}
                 {hostname ? <p role="status">Hostname: {hostname}</p> : null}
-                {encrypt ? (
-                  <p role="status">
-                    Cifrado: intención marcada (no aplicada al disco).
-                  </p>
-                ) : null}
                 {portKind === "mock" ? (
                   <p role="status">Modo demostración (MockCorePort).</p>
                 ) : null}
@@ -1380,7 +1097,7 @@ export function App({ port, portKind }: Props) {
                   disabled={busy}
                   onClick={() => void onForge()}
                 >
-                  {busy ? "Exportando…" : "Exportar"}
+                  Pedir imagen
                 </button>
               </div>
             </section>
@@ -1389,9 +1106,7 @@ export function App({ port, portKind }: Props) {
         <ForgeAside
           kernel={kernel}
           bootTitle={boot?.title ?? "systemd-boot"}
-          filesystemTitle={filesystem?.title ?? "Btrfs"}
           env={env}
-          storage={storage}
           hasManifest={Boolean(manifest)}
           apps={selectedPackages}
           appCount={selectedApps.size}
diff --git a/apps/web/src/ForgeAside.tsx b/apps/web/src/ForgeAside.tsx
index a436712..81be2cf 100644
--- a/apps/web/src/ForgeAside.tsx
+++ b/apps/web/src/ForgeAside.tsx
@@ -1,17 +1,10 @@
 import type { Diagnostic, ResolvedSelection } from "./coreport.js";
 import type { FaceOption, FacePackage } from "./forge-face.js";
-import {
-  labelStorageMode,
-  labelStorageUiState,
-  type StorageIntent,
-} from "./storage-intent.js";
 
 type Props = {
   kernel?: FaceOption;
   bootTitle: string;
-  filesystemTitle: string;
   env?: FaceOption;
-  storage: StorageIntent;
   hasManifest: boolean;
   apps: FacePackage[];
   appCount: number;
@@ -28,9 +21,7 @@ type Props = {
 export function ForgeAside({
   kernel,
   bootTitle,
-  filesystemTitle,
   env,
-  storage,
   hasManifest,
   apps,
   appCount,
@@ -75,24 +66,10 @@ export function ForgeAside({
             <dt>Arranque</dt>
             <dd>{bootTitle}</dd>
           </div>
-          <div>
-            <dt>Sistema de archivos</dt>
-            <dd>{filesystemTitle}</dd>
-          </div>
           <div>
             <dt>Entorno</dt>
             <dd>{env?.title ?? "—"}</dd>
           </div>
-          <div>
-            <dt>Disco</dt>
-            <dd>{labelStorageMode(storage.mode)}</dd>
-          </div>
-          <div>
-            <dt>Estado del plan</dt>
-            <dd data-storage-ui-state={storage.uiState}>
-              {labelStorageUiState(storage.uiState)}
-            </dd>
-          </div>
         </dl>
       </div>
 
diff --git a/apps/web/src/ForgeHeader.tsx b/apps/web/src/ForgeHeader.tsx
index f4f1ab0..1386545 100644
--- a/apps/web/src/ForgeHeader.tsx
+++ b/apps/web/src/ForgeHeader.tsx
@@ -29,7 +29,7 @@ export function ForgeHeader({
             </span>
           </div>
           <div className="forge-subtitle">
-            Configura tu sistema y exporta un perfil. No modifica discos
+            Configura la build. La imagen se pide en Revisión.
           </div>
         </div>
       </div>
diff --git a/apps/web/src/coreport.ts b/apps/web/src/coreport.ts
index 88fc1b4..3629cac 100644
--- a/apps/web/src/coreport.ts
+++ b/apps/web/src/coreport.ts
@@ -265,6 +265,8 @@ export interface CorePort {
   buildManifest(input: BuildManifestInput): Promise<Result<Manifest>>;
   exportArtifact(input: ExportArtifactInput): Promise<Result<Artifact>>;
   importDraft(input: ImportDraftInput): Promise<Result<unknown>>;
+  /** Pide la imagen al proceso de constitución. No acepta un shell ni una ruta. */
+  requestLiveImage(): Promise<Result<never>>;
 }
 
 export function typedError(
diff --git a/apps/web/src/draft-for-core.ts b/apps/web/src/draft-for-core.ts
index f58cefa..e8464bd 100644
--- a/apps/web/src/draft-for-core.ts
+++ b/apps/web/src/draft-for-core.ts
@@ -10,7 +10,8 @@ export type FaceExclusion = {
 /**
  * Face-only selections (intent) and unverified requests stay in the UI draft
  * but must not reach a fully-supported RealCore resolve/validate/manifest.
- * Hostname (text) and encrypt (boolean intention) are kept for core fidelity.
+ * Hostname (text) is kept. Disk, filesystem and encrypt selections do not
+ * reach the engine: the face no longer authors them.
  */
 export function listFaceExclusions(draft: Draft): FaceExclusion[] {
   const exclusions: FaceExclusion[] = [];
@@ -55,8 +56,26 @@ export function listFaceExclusions(draft: Draft): FaceExclusion[] {
   return exclusions;
 }
 
+const DISK_STEPS = new Set<string>([
+  STEP_IDS.filesystem,
+  STEP_IDS.encrypt,
+]);
+
+/** Drop disk plan and disk selections. Imported drafts do not reopen that step. */
+export function withoutDiskPlan(draft: Draft): Draft {
+  const selections = draft.selections.filter(
+    (selection) => !DISK_STEPS.has(selection.stepId),
+  );
+  const next: Draft = { ...draft, selections };
+  delete next.storagePlan;
+  delete next.encryptionPolicy;
+  delete next.inheritedEncryptIntent;
+  return next;
+}
+
 export function draftForCore(draft: Draft): Draft {
-  const selections = draft.selections.flatMap((selection) => {
+  const stripped = withoutDiskPlan(draft);
+  const selections = stripped.selections.flatMap((selection) => {
     if (selection.stepId === STEP_IDS.intent) return [];
     const value = selection.value;
     if (value.kind === "single") {
@@ -75,5 +94,5 @@ export function draftForCore(draft: Draft): Draft {
     }
     return [selection];
   });
-  return { ...draft, selections };
+  return { ...stripped, selections };
 }
diff --git a/apps/web/src/forge-face.ts b/apps/web/src/forge-face.ts
index e3e3670..e70a94d 100644
--- a/apps/web/src/forge-face.ts
+++ b/apps/web/src/forge-face.ts
@@ -65,15 +65,10 @@ export const STEP_IDS = {
 } as const;
 
 export const RAIL_STEPS = [
-  {
-    id: "storage",
-    title: "Disco y particiones",
-    hint: "Modo e intención (sin escritura)",
-  },
   {
     id: "base",
     title: "Sistema base",
-    hint: "Kernel · Arranque · Filesystem",
+    hint: "Kernel · Arranque",
   },
   {
     id: "environment",
@@ -88,12 +83,12 @@ export const RAIL_STEPS = [
   {
     id: "identity-security",
     title: "Identidad y seguridad",
-    hint: "Hostname y cifrado",
+    hint: "Hostname",
   },
   {
     id: "review",
     title: "Revisión",
-    hint: "Resumen y exportación",
+    hint: "Resumen e imagen",
   },
 ] as const;
 
@@ -605,10 +600,6 @@ export const GLOSSARY = [
     title: "cursor",
     body: "Editor con asistencia para escribir código.",
   },
-  {
-    title: "Disco y particiones",
-    body: "Declara el modo de instalación (disco nuevo o reemplazo). Esta fase prepara un perfil y no modifica discos.",
-  },
 ] as const;
 
 /** Initial package option ids present when the face opens (canonical where mapped). */
diff --git a/apps/web/src/mock-core-port.ts b/apps/web/src/mock-core-port.ts
index 961d0de..ebc2ed7 100644
--- a/apps/web/src/mock-core-port.ts
+++ b/apps/web/src/mock-core-port.ts
@@ -66,10 +66,6 @@ function initialSelections(): Selection[] {
       stepId: STEP_IDS.boot,
       value: { kind: "single", optionId: INITIAL_SINGLE.boot },
     },
-    {
-      stepId: STEP_IDS.filesystem,
-      value: { kind: "single", optionId: INITIAL_SINGLE.filesystem },
-    },
     {
       stepId: STEP_IDS.compositor,
       value: { kind: "single", optionId: INITIAL_SINGLE.compositor },
@@ -353,6 +349,7 @@ export class MockCorePort implements CorePort {
   }
 
   async buildManifest(input: BuildManifestInput): Promise<Result<Manifest>> {
+    // El perfil vivo lo renderiza archmaker-core. El mock no inventa nombres de paquete.
     const allowed = ["archmaker-profile", "archinstall-profile", "report"];
     if (!allowed.includes(input.targetRef.id)) {
       return {
@@ -395,7 +392,11 @@ export class MockCorePort implements CorePort {
   }
 
   async exportArtifact(input: ExportArtifactInput): Promise<Result<Artifact>> {
-    if (input.manifest.targetRef.id !== input.targetRef.id) {
+    const allowed = ["archmaker-profile", "archinstall-profile", "report"];
+    if (
+      input.manifest.targetRef.id !== input.targetRef.id ||
+      !allowed.includes(input.targetRef.id)
+    ) {
       return {
         ok: false,
         error: typedError(
@@ -539,4 +540,15 @@ export class MockCorePort implements CorePort {
       },
     };
   }
+
+  async requestLiveImage(): Promise<Result<never>> {
+    return {
+      ok: false,
+      error: typedError(
+        "constitution-mkarchiso-absent",
+        "mock-core",
+        "error.constitution.mkarchisoAbsent",
+      ),
+    };
+  }
 }
diff --git a/apps/web/src/step-progress.ts b/apps/web/src/step-progress.ts
index cd3bdfb..5a12f51 100644
--- a/apps/web/src/step-progress.ts
+++ b/apps/web/src/step-progress.ts
@@ -1,8 +1,4 @@
 import { RAIL_STEPS } from "./forge-face.js";
-import {
-  storageStepComplete,
-  type StorageIntent,
-} from "./storage-intent.js";
 
 export type StepProgress =
   | "visited"
@@ -15,7 +11,6 @@ export type StepProgressInput = {
   current: number;
   visited: ReadonlySet<number>;
   invalid: ReadonlySet<number>;
-  storage: StorageIntent;
   hasDefaults: boolean;
   reviewReady: boolean;
 };
@@ -23,8 +18,6 @@ export type StepProgressInput = {
 function stepComplete(index: number, input: StepProgressInput): boolean {
   const id = RAIL_STEPS[index]?.id;
   switch (id) {
-    case "storage":
-      return storageStepComplete(input.storage);
     case "base":
     case "environment":
     case "apps":
diff --git a/apps/web/src/storage-plan-face.ts b/apps/web/src/storage-plan-face.ts
index d8478f9..67cb8c4 100644
--- a/apps/web/src/storage-plan-face.ts
+++ b/apps/web/src/storage-plan-face.ts
@@ -81,18 +81,13 @@ export function uiStateForIntent(
   return "proposed";
 }
 
-/** Alinea schema v2 y políticas derivadas de selections (espejo de project_declared_v2_fields). */
-export function withFaceV2Fields(draft: Draft, intent: StorageIntent): Draft {
+/** Alinea schema v2. No autora plan de disco ni cifrado. */
+export function withFaceV2Fields(draft: Draft): Draft {
   const apps = draft.selections.find((s) => s.stepId === STEP_IDS.apps);
   const browserIds =
     apps?.value.kind === "multiple"
       ? apps.value.optionIds.filter((id) => id.startsWith("archmaker.browser."))
       : [];
-  const encryptSel = draft.selections.find(
-    (s) => s.stepId === STEP_IDS.encrypt,
-  );
-  const encrypt =
-    encryptSel?.value.kind === "boolean" ? encryptSel.value.value : false;
 
   const defaultBrowser =
     draft.browserPolicy?.defaultBrowserId &&
@@ -102,19 +97,21 @@ export function withFaceV2Fields(draft: Draft, intent: StorageIntent): Draft {
         ? DEFAULT_BROWSER_ID
         : (browserIds[0] ?? null);
 
+  const {
+    storagePlan: _storagePlan,
+    encryptionPolicy: _encryptionPolicy,
+    inheritedEncryptIntent: _inheritedEncryptIntent,
+    ...rest
+  } = draft;
+
   return {
-    ...draft,
+    ...rest,
+    selections: rest.selections.filter(
+      (selection) =>
+        selection.stepId !== STEP_IDS.filesystem &&
+        selection.stepId !== STEP_IDS.encrypt,
+    ),
     schemaVersion: "2",
-    storagePlan: storagePlanFromIntent(intent),
-    encryptionPolicy: encrypt
-      ? {
-          kind: "luks2",
-          unlock: "passphrase-requested-at-install",
-          coversMountPoint: "/",
-        }
-      : { kind: "none" },
-    inheritedEncryptIntent:
-      encryptSel?.value.kind === "boolean" ? encrypt : undefined,
     browserPolicy: {
       selectedBrowserIds: browserIds,
       defaultBrowserId: defaultBrowser,
diff --git a/apps/web/src/styles.css b/apps/web/src/styles.css
index 230a5fd..d98d412 100644
--- a/apps/web/src/styles.css
+++ b/apps/web/src/styles.css
@@ -117,7 +117,10 @@
   }
   .forge-shell {
     display: grid;
-    grid-template-columns: minmax(12rem, 17.5rem) minmax(0, 1fr) minmax(14rem, 22.5rem);
+    grid-template-columns: minmax(12rem, 17.5rem) minmax(0, 1fr) minmax(
+        14rem,
+        22.5rem
+      );
     gap: 0;
     align-items: start;
     min-height: calc(100vh - 4rem);
@@ -335,6 +338,9 @@
     font-size: 1.375rem;
     margin: 0;
   }
+  .forge-main h2.forge-section-label {
+    font-size: 0.8125rem;
+  }
   .forge-lead {
     color: var(--color-text-muted);
     font-size: 0.875rem;
@@ -442,7 +448,11 @@
   }
   .forge-info-card.is-accent {
     background: var(--option-card-selected-bg);
-    border-color: color-mix(in oklab, var(--color-action) 30%, var(--color-border));
+    border-color: color-mix(
+      in oklab,
+      var(--color-action) 30%,
+      var(--color-border)
+    );
   }
   .forge-info-card p,
   .forge-diag p {
@@ -664,7 +674,11 @@
   }
   .forge-diag-warn {
     border-left-color: var(--color-warning);
-    background: color-mix(in oklab, var(--color-warning) 12%, var(--color-canvas));
+    background: color-mix(
+      in oklab,
+      var(--color-warning) 12%,
+      var(--color-canvas)
+    );
   }
   .forge-app-list {
     list-style: none;
diff --git a/apps/web/src/tauri-core-port.ts b/apps/web/src/tauri-core-port.ts
index 8ad6452..b388e99 100644
--- a/apps/web/src/tauri-core-port.ts
+++ b/apps/web/src/tauri-core-port.ts
@@ -96,4 +96,7 @@ export class TauriCorePort implements CorePort {
   importDraft(input: ImportDraftInput): Promise<Result<unknown>> {
     return this.call<unknown>("import_draft", input);
   }
+  requestLiveImage(): Promise<Result<never>> {
+    return this.call<never>("constitute_image", {});
+  }
 }
diff --git a/apps/web/src/wasm-core-port.ts b/apps/web/src/wasm-core-port.ts
index 7cc9c8a..55b7318 100644
--- a/apps/web/src/wasm-core-port.ts
+++ b/apps/web/src/wasm-core-port.ts
@@ -160,4 +160,14 @@ export class WasmCorePort implements CorePort {
   importDraft(input: ImportDraftInput): Promise<Result<unknown>> {
     return this.call<unknown>("import_draft", input);
   }
+  requestLiveImage(): Promise<Result<never>> {
+    return Promise.resolve({
+      ok: false,
+      error: typedError(
+        "constitution-mkarchiso-absent",
+        "archmaker-wasm",
+        "error.constitution.mkarchisoAbsent",
+      ),
+    });
+  }
 }
diff --git a/apps/web/visual-baselines/home-dark.png b/apps/web/visual-baselines/home-dark.png
index a0b4fa9..9d392a6 100644
Binary files a/apps/web/visual-baselines/home-dark.png and b/apps/web/visual-baselines/home-dark.png differ
diff --git a/apps/web/visual-baselines/home-high-contrast.png b/apps/web/visual-baselines/home-high-contrast.png
index 3ef9513..d833f0f 100644
Binary files a/apps/web/visual-baselines/home-high-contrast.png and b/apps/web/visual-baselines/home-high-contrast.png differ
diff --git a/apps/web/visual-baselines/home-light.png b/apps/web/visual-baselines/home-light.png
index 373fb0a..9d392a6 100644
Binary files a/apps/web/visual-baselines/home-light.png and b/apps/web/visual-baselines/home-light.png differ
diff --git a/apps/web/visual-baselines/home-reduced-motion.png b/apps/web/visual-baselines/home-reduced-motion.png
index a0b4fa9..9d392a6 100644
Binary files a/apps/web/visual-baselines/home-reduced-motion.png and b/apps/web/visual-baselines/home-reduced-motion.png differ
diff --git a/apps/web/visual-regression.test.ts b/apps/web/visual-regression.test.ts
index 269e0f6..5060c8c 100644
--- a/apps/web/visual-regression.test.ts
+++ b/apps/web/visual-regression.test.ts
@@ -81,7 +81,7 @@ test.describe("Visual regression", () => {
     await page.waitForLoadState("networkidle");
     // Wait for async CorePort boot + draft (not the empty/loading shell).
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 60_000 });
     // CSS externo /forge-face.css (CSP style-src 'self'); fija Liberation Sans.
     // Resolve against origin — BASE_URL includes ?mock=1.
diff --git a/apps/web/wasm-flow.playwright.test.ts b/apps/web/wasm-flow.playwright.test.ts
index 2c960b5..7487e47 100644
--- a/apps/web/wasm-flow.playwright.test.ts
+++ b/apps/web/wasm-flow.playwright.test.ts
@@ -1,8 +1,7 @@
 import { test, expect } from "@playwright/test";
 import {
   completeExampleSelection,
-  generateExportAndAssertFidelity,
-  sha256FileHex,
+  generateAndAskForImage,
 } from "./e2e-fidelity-helpers.js";
 
 /**
@@ -21,7 +20,7 @@ test.describe("WASM CorePort — recorrido real", () => {
       page.getByRole("heading", { name: /Motor no disponible/i }),
     ).toHaveCount(0);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 60_000 });
     await expect(page.locator("#toast-region")).toContainText(/Draft listo/i, {
       timeout: 60_000,
@@ -34,7 +33,7 @@ test.describe("WASM CorePort — recorrido real", () => {
   }) => {
     test.setTimeout(120_000);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 60_000 });
     await expect(page.locator("#toast-region")).toContainText(/Draft listo/i, {
       timeout: 60_000,
@@ -48,30 +47,21 @@ test.describe("WASM CorePort — recorrido real", () => {
     // Edit via rail (invalidates prepare).
     await page
       .getByRole("navigation", { name: /Pasos del configurador$/i })
-      .getByRole("button", { name: /Disco y particiones/i })
+      .getByRole("button", { name: /Sistema base/i })
       .click();
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible();
-    await page
-      .getByRole("radio", { name: /Disco nuevo o sin datos a conservar/i })
-      .click();
+    await page.getByRole("radio", { name: /Linux Zen/i }).click();
     await page.getByRole("button", { name: "Generar" }).click();
     await expect(page.getByRole("heading", { name: "Revisión" })).toBeVisible();
     await expect(page.locator("#toast-region")).toContainText(
       /Manifest listo|Validación/i,
       { timeout: 60_000 },
     );
-    const downloadPromise = page.waitForEvent("download");
-    await page.getByRole("button", { name: "Exportar" }).click();
-    const download = await downloadPromise;
-    expect(download.suggestedFilename()).toMatch(/\.json$/);
-    const path = await download.path();
-    expect(path).toBeTruthy();
-    const digest = sha256FileHex(path!);
-    expect(digest).toMatch(/^[0-9a-f]{64}$/);
+    await page.getByRole("button", { name: "Pedir imagen" }).click();
     await expect(page.locator("#toast-region")).toContainText(
-      new RegExp(`Descarga iniciada \\(${digest.slice(0, 12)}`),
+      /constitution-mkarchiso-absent/,
       { timeout: 15_000 },
     );
   });
@@ -81,14 +71,13 @@ test.describe("WASM CorePort — recorrido real", () => {
   }) => {
     test.setTimeout(180_000);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 60_000 });
     await expect(page.locator("#toast-region")).toContainText(/Draft listo/i, {
       timeout: 60_000,
     });
     await completeExampleSelection(page);
-    const { digest } = await generateExportAndAssertFidelity(page);
-    expect(digest).toHaveLength(64);
+    await generateAndAskForImage(page);
   });
 
   test("reimportar el manifiesto muestra AM-MIG-001 en el toast", async ({
@@ -96,19 +85,18 @@ test.describe("WASM CorePort — recorrido real", () => {
   }) => {
     test.setTimeout(120_000);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 60_000 });
     await expect(page.locator("#toast-region")).toContainText(/Draft listo/i, {
       timeout: 60_000,
     });
     await page.getByRole("button", { name: "Generar" }).click();
     await expect(page.getByRole("heading", { name: "Revisión" })).toBeVisible();
-    const downloadPromise = page.waitForEvent("download");
-    await page.getByRole("button", { name: "Exportar" }).click();
-    const download = await downloadPromise;
-    const path = await download.path();
-    expect(path).toBeTruthy();
-    await page.locator('input[type="file"]').setInputFiles(path!);
+    await page.locator('input[type="file"]').setInputFiles({
+      name: "no-es-perfil.json",
+      mimeType: "application/json",
+      buffer: Buffer.from('{"ok":true}'),
+    });
     const toast = page.locator(".forge-toast");
     await expect(toast).toContainText("AM-MIG-001", { timeout: 15_000 });
     const box = await toast.boundingBox();
diff --git a/apps/web/wasm-offline.playwright.test.ts b/apps/web/wasm-offline.playwright.test.ts
index 2fee76f..8b33ec9 100644
--- a/apps/web/wasm-offline.playwright.test.ts
+++ b/apps/web/wasm-offline.playwright.test.ts
@@ -19,7 +19,7 @@ test.describe("WASM CorePort — offline tras carga", () => {
       page.getByRole("heading", { name: /Motor no disponible/i }),
     ).toHaveCount(0);
     await expect(
-      page.getByRole("heading", { name: /Disco y particiones/i }),
+      page.getByRole("heading", { name: /Sistema base/i }),
     ).toBeVisible({ timeout: 60_000 });
     await expect(page.locator("#toast-region")).toContainText(/Draft listo/i, {
       timeout: 60_000,
@@ -28,12 +28,6 @@ test.describe("WASM CorePort — offline tras carga", () => {
 
     await context.setOffline(true);
 
-    await page
-      .getByRole("radio", { name: /Disco nuevo o sin datos a conservar/i })
-      .click();
-    await page
-      .getByRole("button", { name: /Continuar → Sistema base/i })
-      .click();
     await expect(
       page.getByRole("heading", { name: "Sistema base" }),
     ).toBeVisible({
diff --git a/contracts/json-schema/application-contract.schema.json b/contracts/json-schema/application-contract.schema.json
index d9fe2e6..5c0bc70 100644
--- a/contracts/json-schema/application-contract.schema.json
+++ b/contracts/json-schema/application-contract.schema.json
@@ -53,7 +53,12 @@
     "format": {
       "description": "Admitted export format (DEC-001). Image is not admitted.",
       "type": "string",
-      "enum": ["archmaker-profile", "archinstall-profile", "report"]
+      "enum": [
+        "archmaker-profile",
+        "archinstall-profile",
+        "report",
+        "archmaker-live-profile"
+      ]
     },
     "clauses": {
       "description": "Closed list of seven clauses. Order is fixed.",
diff --git a/contracts/json-schema/artifact.schema.json b/contracts/json-schema/artifact.schema.json
index 5002775..80007a4 100644
--- a/contracts/json-schema/artifact.schema.json
+++ b/contracts/json-schema/artifact.schema.json
@@ -35,7 +35,12 @@
       "properties": {
         "id": {
           "description": "Export target identifier.",
-          "enum": ["archmaker-profile", "archinstall-profile", "report"]
+          "enum": [
+            "archmaker-profile",
+            "archinstall-profile",
+            "report",
+            "archmaker-live-profile"
+          ]
         },
         "version": {
           "description": "Target adapter version (axis targetRef.version).",
diff --git a/contracts/json-schema/clause-bytes.schema.json b/contracts/json-schema/clause-bytes.schema.json
index 921cd10..1615ee3 100644
--- a/contracts/json-schema/clause-bytes.schema.json
+++ b/contracts/json-schema/clause-bytes.schema.json
@@ -21,7 +21,12 @@
     },
     "format": {
       "type": "string",
-      "enum": ["archmaker-profile", "archinstall-profile", "report"]
+      "enum": [
+        "archmaker-profile",
+        "archinstall-profile",
+        "report",
+        "archmaker-live-profile"
+      ]
     },
     "exportA": {
       "$ref": "#/$defs/exportSample"
diff --git a/contracts/json-schema/clause-manifest.schema.json b/contracts/json-schema/clause-manifest.schema.json
index 465dc0d..140af21 100644
--- a/contracts/json-schema/clause-manifest.schema.json
+++ b/contracts/json-schema/clause-manifest.schema.json
@@ -24,11 +24,21 @@
     },
     "formatA": {
       "type": "string",
-      "enum": ["archmaker-profile", "archinstall-profile", "report"]
+      "enum": [
+        "archmaker-profile",
+        "archinstall-profile",
+        "report",
+        "archmaker-live-profile"
+      ]
     },
     "formatB": {
       "type": "string",
-      "enum": ["archmaker-profile", "archinstall-profile", "report"]
+      "enum": [
+        "archmaker-profile",
+        "archinstall-profile",
+        "report",
+        "archmaker-live-profile"
+      ]
     },
     "digestAfterFormatA": {
       "$ref": "https://archmaker.dev/schemas/common.schema.json#/$defs/contentDigest"
diff --git a/crates/archmaker-constitute/Cargo.toml b/crates/archmaker-constitute/Cargo.toml
new file mode 100644
index 0000000..4681713
--- /dev/null
+++ b/crates/archmaker-constitute/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "archmaker-constitute"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Proceso de constitución: descarga tipada del perfil sellado. No es el runner de instalación."
+
+[[bin]]
+name = "archmaker-constitute"
+path = "src/main.rs"
+
+[dependencies]
+hex = "0.4"
+serde_json = "1"
+sha2 = "0.10"
diff --git a/crates/archmaker-constitute/src/lib.rs b/crates/archmaker-constitute/src/lib.rs
new file mode 100644
index 0000000..9a4431f
--- /dev/null
+++ b/crates/archmaker-constitute/src/lib.rs
@@ -0,0 +1,348 @@
+//! Descarga tipada de los nombres del perfil vivo (ISO-03).
+//!
+//! Un solo proceso, una sola operación. No abre red, no ejecuta shell y no
+//! escribe bajo `airootfs/`. El binario no acepta scripts.
+
+use std::collections::BTreeSet;
+use std::fs;
+use std::io::Read;
+use std::path::{Component, Path};
+
+use sha2::{Digest, Sha256};
+
+pub const CODE_OFFLINE: &str = "constitution-offline";
+pub const CODE_OUTSIDE: &str = "constitution-name-outside-profile";
+pub const CODE_DEFERRED: &str = "constitution-deferred-not-embedded";
+pub const CODE_SCRIPT: &str = "constitution-script-rejected";
+pub const CODE_DIGEST: &str = "constitution-digest-mismatch";
+pub const CODE_OUTPUT: &str = "constitution-unsafe-output";
+pub const CODE_IMAGE_ABSENT: &str = "constitution-mkarchiso-absent";
+pub const CODE_IMAGE_REFUSED: &str = "constitution-mkarchiso-refused";
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ConstituteError {
+    pub code: &'static str,
+    pub name: Option<String>,
+}
+
+impl ConstituteError {
+    fn new(code: &'static str) -> Self {
+        Self { code, name: None }
+    }
+
+    fn named(code: &'static str, name: impl Into<String>) -> Self {
+        Self {
+            code,
+            name: Some(name.into()),
+        }
+    }
+
+    pub fn to_json(&self) -> String {
+        let mut body = serde_json::json!({
+            "ok": false,
+            "code": self.code,
+        });
+        if let Some(name) = &self.name {
+            body["name"] = serde_json::Value::String(name.clone());
+        }
+        body.to_string()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct JournalEntry {
+    pub name: String,
+    pub sha256: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LiveProfilePackages {
+    pub install: BTreeSet<String>,
+    pub deferred: BTreeSet<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FetchOutcome {
+    pub journal: Vec<JournalEntry>,
+}
+
+pub fn parse_live_profile(bytes: &[u8]) -> Result<LiveProfilePackages, ConstituteError> {
+    let value: serde_json::Value =
+        serde_json::from_slice(bytes).map_err(|_| ConstituteError::new(CODE_SCRIPT))?;
+    if value.get("script").is_some()
+        || value.get("cmd").is_some()
+        || value.get("pacstrap").is_some()
+    {
+        return Err(ConstituteError::new(CODE_SCRIPT));
+    }
+    let packages = value
+        .get("files")
+        .and_then(|files| files.get("packages.x86_64"))
+        .and_then(|text| text.as_str())
+        .ok_or_else(|| ConstituteError::new(CODE_SCRIPT))?;
+    let mut install = BTreeSet::new();
+    for line in packages.lines() {
+        let name = line.trim();
+        if name.is_empty() {
+            continue;
+        }
+        if !package_name_ok(name) {
+            return Err(ConstituteError::new(CODE_SCRIPT));
+        }
+        install.insert(name.to_string());
+    }
+    if install.is_empty() {
+        return Err(ConstituteError::new(CODE_SCRIPT));
+    }
+    let mut deferred = BTreeSet::new();
+    if let Some(list) = value.get("deferredFetch").and_then(|v| v.as_array()) {
+        for item in list {
+            let Some(name) = item.as_str() else {
+                return Err(ConstituteError::new(CODE_SCRIPT));
+            };
+            if !package_name_ok(name) {
+                return Err(ConstituteError::new(CODE_SCRIPT));
+            }
+            deferred.insert(name.to_string());
+        }
+    }
+    for name in &deferred {
+        install.remove(name);
+    }
+    Ok(LiveProfilePackages { install, deferred })
+}
+
+pub fn fetch_packages(
+    profile: &LiveProfilePackages,
+    names: &[String],
+    fixture_dir: &Path,
+    out_dir: &Path,
+) -> Result<FetchOutcome, ConstituteError> {
+    if path_contains_airootfs(out_dir) || path_contains_airootfs(fixture_dir) {
+        return Err(ConstituteError::new(CODE_OUTPUT));
+    }
+    if !fixture_dir.is_dir() {
+        return Err(ConstituteError::new(CODE_OFFLINE));
+    }
+    let requested: Vec<String> = if names.is_empty() {
+        profile.install.iter().cloned().collect()
+    } else {
+        names.to_vec()
+    };
+    let mut staged: Vec<(String, Vec<u8>, Option<String>)> = Vec::with_capacity(requested.len());
+    for name in &requested {
+        if !package_name_ok(name) {
+            return Err(ConstituteError::named(CODE_OUTSIDE, name));
+        }
+        if profile.deferred.contains(name) {
+            return Err(ConstituteError::named(CODE_DEFERRED, name));
+        }
+        if !profile.install.contains(name) {
+            return Err(ConstituteError::named(CODE_OUTSIDE, name));
+        }
+        let source = fixture_dir.join(name);
+        if !source.is_file() {
+            return Err(ConstituteError::named(CODE_OFFLINE, name));
+        }
+        let bytes = read_regular_file(&source)?;
+        let cited = match read_sidecar_digest(fixture_dir, name)? {
+            Some(expected) => {
+                let actual = sha256_hex(&bytes);
+                if actual != expected {
+                    return Err(ConstituteError::named(CODE_DIGEST, name));
+                }
+                Some(expected)
+            }
+            None => None,
+        };
+        staged.push((name.clone(), bytes, cited));
+    }
+    fs::create_dir_all(out_dir).map_err(|_| ConstituteError::new(CODE_OUTPUT))?;
+    let mut journal = Vec::with_capacity(staged.len());
+    for (name, bytes, sha256) in staged {
+        let dest = out_dir.join(&name);
+        if path_contains_airootfs(&dest) {
+            return Err(ConstituteError::new(CODE_OUTPUT));
+        }
+        fs::write(&dest, bytes).map_err(|_| ConstituteError::new(CODE_OUTPUT))?;
+        journal.push(JournalEntry { name, sha256 });
+    }
+    let journal_body = serde_json::to_string(&journal_json(&journal))
+        .map_err(|_| ConstituteError::new(CODE_OUTPUT))?;
+    fs::write(out_dir.join("journal.json"), journal_body)
+        .map_err(|_| ConstituteError::new(CODE_OUTPUT))?;
+    Ok(FetchOutcome { journal })
+}
+
+/// La cara pide la imagen con esta operación. No recibe un directorio ni un script.
+/// Sin `mkarchiso` en el path de búsqueda no crea ficheros. Si el binario está,
+/// tampoco lo ejecuta: el WebView no es el sitio de la corrida.
+pub fn request_live_image(search_path: &str) -> ConstituteError {
+    if find_mkarchiso(search_path).is_none() {
+        ConstituteError::new(CODE_IMAGE_ABSENT)
+    } else {
+        ConstituteError::new(CODE_IMAGE_REFUSED)
+    }
+}
+
+fn find_mkarchiso(search_path: &str) -> Option<std::path::PathBuf> {
+    for dir in search_path.split(':') {
+        if dir.is_empty() {
+            continue;
+        }
+        let candidate = Path::new(dir).join("mkarchiso");
+        if candidate.is_file() {
+            return Some(candidate);
+        }
+    }
+    None
+}
+
+pub fn run_args(args: &[String]) -> Result<String, ConstituteError> {
+    match args.first().map(String::as_str) {
+        Some("image") => {
+            if args.len() != 1 {
+                return Err(ConstituteError::new(CODE_SCRIPT));
+            }
+            let search = std::env::var("PATH").unwrap_or_default();
+            return Err(request_live_image(&search));
+        }
+        Some("fetch") => {}
+        _ => return Err(ConstituteError::new(CODE_SCRIPT)),
+    }
+    let mut profile_path: Option<&str> = None;
+    let mut fixture_path: Option<&str> = None;
+    let mut out_path: Option<&str> = None;
+    let mut names: Vec<String> = Vec::new();
+    let mut iter = args.iter().skip(1);
+    while let Some(arg) = iter.next() {
+        match arg.as_str() {
+            "--profile" => {
+                profile_path = Some(
+                    iter.next()
+                        .ok_or_else(|| ConstituteError::new(CODE_SCRIPT))?
+                        .as_str(),
+                );
+            }
+            "--fixture" => {
+                fixture_path = Some(
+                    iter.next()
+                        .ok_or_else(|| ConstituteError::new(CODE_SCRIPT))?
+                        .as_str(),
+                );
+            }
+            "--out" => {
+                out_path = Some(
+                    iter.next()
+                        .ok_or_else(|| ConstituteError::new(CODE_SCRIPT))?
+                        .as_str(),
+                );
+            }
+            "--name" => {
+                let name = iter
+                    .next()
+                    .ok_or_else(|| ConstituteError::new(CODE_SCRIPT))?;
+                names.push(name.clone());
+            }
+            "--script" | "--cmd" | "-c" | "sh" => {
+                return Err(ConstituteError::new(CODE_SCRIPT));
+            }
+            _ => return Err(ConstituteError::new(CODE_SCRIPT)),
+        }
+    }
+    let (Some(profile_path), Some(fixture_path), Some(out_path)) =
+        (profile_path, fixture_path, out_path)
+    else {
+        return Err(ConstituteError::new(CODE_SCRIPT));
+    };
+    let profile_bytes = fs::read(profile_path).map_err(|_| ConstituteError::new(CODE_OFFLINE))?;
+    let profile = parse_live_profile(&profile_bytes)?;
+    let outcome = fetch_packages(
+        &profile,
+        &names,
+        Path::new(fixture_path),
+        Path::new(out_path),
+    )?;
+    Ok(serde_json::json!({
+        "ok": true,
+        "journal": journal_json(&outcome.journal),
+    })
+    .to_string())
+}
+
+fn journal_json(journal: &[JournalEntry]) -> Vec<serde_json::Value> {
+    journal
+        .iter()
+        .map(|entry| {
+            let mut item = serde_json::json!({ "name": entry.name });
+            if let Some(digest) = &entry.sha256 {
+                item["sha256"] = serde_json::Value::String(digest.clone());
+            }
+            item
+        })
+        .collect()
+}
+
+fn package_name_ok(name: &str) -> bool {
+    let mut chars = name.chars();
+    match chars.next() {
+        Some(first) if first.is_ascii_lowercase() || first.is_ascii_digit() => {}
+        _ => return false,
+    }
+    name.chars()
+        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || matches!(c, '+' | '.' | '_' | '-'))
+        && !name.contains("pacstrap")
+        && !name.contains("cmd")
+}
+
+fn path_contains_airootfs(path: &Path) -> bool {
+    path.components().any(|component| match component {
+        Component::Normal(part) => part == "airootfs",
+        _ => false,
+    })
+}
+
+fn read_regular_file(path: &Path) -> Result<Vec<u8>, ConstituteError> {
+    let mut file = fs::File::open(path).map_err(|_| ConstituteError::new(CODE_OFFLINE))?;
+    let meta = file
+        .metadata()
+        .map_err(|_| ConstituteError::new(CODE_OFFLINE))?;
+    if !meta.is_file() {
+        return Err(ConstituteError::new(CODE_OFFLINE));
+    }
+    let mut bytes = Vec::new();
+    file.read_to_end(&mut bytes)
+        .map_err(|_| ConstituteError::new(CODE_OFFLINE))?;
+    Ok(bytes)
+}
+
+fn read_sidecar_digest(fixture_dir: &Path, name: &str) -> Result<Option<String>, ConstituteError> {
+    let path = fixture_dir.join(format!("{name}.sha256"));
+    if !path.exists() {
+        return Ok(None);
+    }
+    let text = fs::read_to_string(&path).map_err(|_| ConstituteError::new(CODE_OFFLINE))?;
+    let digest = text.split_whitespace().next().unwrap_or("").trim();
+    if digest.len() != 64 || !digest.chars().all(|c| c.is_ascii_hexdigit()) {
+        return Err(ConstituteError::named(CODE_DIGEST, name));
+    }
+    Ok(Some(digest.to_ascii_lowercase()))
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+#[cfg(test)]
+mod source_guard {
+    #[test]
+    fn library_does_not_spawn_a_process_or_open_the_network() {
+        let src = include_str!("lib.rs");
+        let spawn = format!("{}{}", "Command", "::");
+        let net = format!("{}{}", "Tcp", "Stream");
+        let url = format!("{}{}", "https", "://");
+        assert!(!src.contains(&spawn));
+        assert!(!src.contains(&net));
+        assert!(!src.contains(&url));
+    }
+}
diff --git a/crates/archmaker-constitute/src/main.rs b/crates/archmaker-constitute/src/main.rs
new file mode 100644
index 0000000..7d937a1
--- /dev/null
+++ b/crates/archmaker-constitute/src/main.rs
@@ -0,0 +1,12 @@
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    match archmaker_constitute::run_args(&args) {
+        Ok(body) => {
+            println!("{body}");
+        }
+        Err(error) => {
+            println!("{}", error.to_json());
+            std::process::exit(1);
+        }
+    }
+}
diff --git a/crates/archmaker-constitute/tests/fetch.rs b/crates/archmaker-constitute/tests/fetch.rs
new file mode 100644
index 0000000..7a7c063
--- /dev/null
+++ b/crates/archmaker-constitute/tests/fetch.rs
@@ -0,0 +1,201 @@
+use std::fs;
+use std::path::PathBuf;
+use std::process::Command;
+
+use archmaker_constitute::{
+    fetch_packages, parse_live_profile, request_live_image, run_args, CODE_DEFERRED,
+    CODE_IMAGE_ABSENT, CODE_IMAGE_REFUSED, CODE_OFFLINE, CODE_OUTSIDE, CODE_SCRIPT,
+};
+use sha2::{Digest, Sha256};
+
+fn profile(install: &str, deferred: &str) -> String {
+    format!(r#"{{"files":{{"packages.x86_64":"{install}"}},"deferredFetch":[{deferred}]}}"#)
+}
+
+fn temp_dir(label: &str) -> PathBuf {
+    let path = std::env::temp_dir().join(format!(
+        "archmaker-constitute-{label}-{}",
+        std::process::id()
+    ));
+    let _ = fs::remove_dir_all(&path);
+    fs::create_dir_all(&path).expect("temp");
+    path
+}
+
+#[test]
+fn fixture_fetch_stays_inside_profile_and_cites_digest() {
+    let root = temp_dir("ok");
+    let fixture = root.join("fixture");
+    let out = root.join("cache");
+    fs::create_dir_all(&fixture).unwrap();
+    let bytes = b"linux-bytes";
+    fs::write(fixture.join("linux"), bytes).unwrap();
+    fs::write(fixture.join("gnome-shell"), b"gnome-bytes").unwrap();
+    let digest = hex::encode(Sha256::digest(bytes));
+    fs::write(fixture.join("linux.sha256"), format!("{digest}\n")).unwrap();
+
+    let parsed = parse_live_profile(profile("linux\\ngnome-shell\\n", "").as_bytes()).unwrap();
+    let outcome = fetch_packages(&parsed, &[], &fixture, &out).unwrap();
+    assert_eq!(outcome.journal.len(), 2);
+    assert!(outcome.journal.iter().all(|entry| {
+        parsed.install.contains(&entry.name) && fs::read(out.join(&entry.name)).is_ok()
+    }));
+    let linux = outcome
+        .journal
+        .iter()
+        .find(|entry| entry.name == "linux")
+        .unwrap();
+    assert_eq!(linux.sha256.as_deref(), Some(digest.as_str()));
+    let gnome = outcome
+        .journal
+        .iter()
+        .find(|entry| entry.name == "gnome-shell")
+        .unwrap();
+    assert!(gnome.sha256.is_none());
+    assert!(!out.join("airootfs").exists());
+    let _ = fs::remove_dir_all(&root);
+}
+
+#[test]
+fn missing_fixture_is_offline_and_writes_nothing() {
+    let root = temp_dir("offline");
+    let out = root.join("cache");
+    let parsed = parse_live_profile(profile("linux\\n", "").as_bytes()).unwrap();
+    let error = fetch_packages(&parsed, &[], &root.join("no-fixture"), &out).unwrap_err();
+    assert_eq!(error.code, CODE_OFFLINE);
+    assert!(!out.exists());
+    let _ = fs::remove_dir_all(&root);
+}
+
+#[test]
+fn name_outside_profile_is_rejected() {
+    let root = temp_dir("outside");
+    let fixture = root.join("fixture");
+    let out = root.join("cache");
+    fs::create_dir_all(&fixture).unwrap();
+    fs::write(fixture.join("linux"), b"linux").unwrap();
+    fs::write(fixture.join("bash"), b"no").unwrap();
+    let parsed = parse_live_profile(profile("linux\\n", "").as_bytes()).unwrap();
+    let error = fetch_packages(&parsed, &["bash".to_string()], &fixture, &out).unwrap_err();
+    assert_eq!(error.code, CODE_OUTSIDE);
+    assert_eq!(error.name.as_deref(), Some("bash"));
+    assert!(!out.join("bash").exists());
+    let _ = fs::remove_dir_all(&root);
+}
+
+#[test]
+fn deferred_bin_is_not_copied_into_output() {
+    let root = temp_dir("deferred");
+    let fixture = root.join("fixture");
+    let out = root.join("cache");
+    fs::create_dir_all(&fixture).unwrap();
+    fs::write(fixture.join("linux"), b"linux").unwrap();
+    fs::write(fixture.join("onlyoffice-bin"), b"blob").unwrap();
+    let parsed = parse_live_profile(profile("linux\\n", "\"onlyoffice-bin\"").as_bytes()).unwrap();
+    let error =
+        fetch_packages(&parsed, &["onlyoffice-bin".to_string()], &fixture, &out).unwrap_err();
+    assert_eq!(error.code, CODE_DEFERRED);
+    assert!(!out.join("onlyoffice-bin").exists());
+    assert!(!root.join("airootfs").exists());
+    let _ = fs::remove_dir_all(&root);
+}
+
+#[test]
+fn output_named_airootfs_is_refused() {
+    let root = temp_dir("airoot");
+    let fixture = root.join("fixture");
+    let out = root.join("airootfs");
+    fs::create_dir_all(&fixture).unwrap();
+    fs::write(fixture.join("linux"), b"linux").unwrap();
+    let parsed = parse_live_profile(profile("linux\\n", "").as_bytes()).unwrap();
+    let error = fetch_packages(&parsed, &[], &fixture, &out).unwrap_err();
+    assert_eq!(error.code, "constitution-unsafe-output");
+    assert!(!out.join("linux").exists());
+    let _ = fs::remove_dir_all(&root);
+}
+
+#[test]
+fn a_profile_line_that_is_not_a_package_name_is_rejected() {
+    let bad = r#"{"files":{"packages.x86_64":"linux;id\n"}}"#;
+    let error = parse_live_profile(bad.as_bytes()).unwrap_err();
+    assert_eq!(error.code, CODE_SCRIPT);
+}
+
+#[test]
+fn argv_rejects_a_script_and_the_bin_fetches_the_fixture() {
+    let rejected = run_args(&["sh".into(), "-c".into(), "true".into()]).unwrap_err();
+    assert_eq!(rejected.code, CODE_SCRIPT);
+    let rejected = run_args(&["fetch".into(), "--script".into(), "true".into()]).unwrap_err();
+    assert_eq!(rejected.code, CODE_SCRIPT);
+
+    let root = temp_dir("bin");
+    let fixture = root.join("fixture");
+    let out = root.join("cache");
+    let profile_path = root.join("profile.json");
+    fs::create_dir_all(&fixture).unwrap();
+    fs::write(fixture.join("linux"), b"linux-bytes").unwrap();
+    let digest = hex::encode(Sha256::digest(b"linux-bytes"));
+    fs::write(fixture.join("linux.sha256"), &digest).unwrap();
+    fs::write(&profile_path, profile("linux\\n", "")).unwrap();
+
+    let bin = env!("CARGO_BIN_EXE_archmaker-constitute");
+    let output = Command::new(bin)
+        .arg("fetch")
+        .arg("--profile")
+        .arg(&profile_path)
+        .arg("--fixture")
+        .arg(&fixture)
+        .arg("--out")
+        .arg(&out)
+        .output()
+        .expect("proceso");
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stdout)
+    );
+    let body: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(body["ok"], true);
+    assert_eq!(body["journal"][0]["name"], "linux");
+    assert_eq!(body["journal"][0]["sha256"], digest);
+    assert_eq!(fs::read(out.join("linux")).unwrap(), b"linux-bytes");
+
+    let offline = Command::new(bin)
+        .arg("fetch")
+        .arg("--profile")
+        .arg(&profile_path)
+        .arg("--fixture")
+        .arg(root.join("sin-red"))
+        .arg("--out")
+        .arg(root.join("vacio"))
+        .output()
+        .expect("proceso");
+    assert!(!offline.status.success());
+    let err: serde_json::Value = serde_json::from_slice(&offline.stdout).unwrap();
+    assert_eq!(err["code"], CODE_OFFLINE);
+    assert!(!root.join("vacio").exists());
+    let _ = fs::remove_dir_all(&root);
+}
+
+#[test]
+fn image_request_does_not_create_an_iso_or_accept_a_script() {
+    let empty = temp_dir("sin-mkarchiso");
+    let absent = request_live_image(empty.to_str().expect("utf8"));
+    assert_eq!(absent.code, CODE_IMAGE_ABSENT);
+    assert!(fs::read_dir(&empty).unwrap().next().is_none());
+
+    let with_tool = temp_dir("con-nombre");
+    fs::write(with_tool.join("mkarchiso"), b"").unwrap();
+    let refused = request_live_image(with_tool.to_str().expect("utf8"));
+    assert_eq!(refused.code, CODE_IMAGE_REFUSED);
+    assert!(fs::read_dir(&with_tool)
+        .unwrap()
+        .all(|entry| { entry.unwrap().file_name() == "mkarchiso" }));
+
+    let script = run_args(&["image".into(), "--script".into()]).expect_err("script");
+    assert_eq!(script.code, CODE_SCRIPT);
+    let host = run_args(&["image".into()]).expect_err("sin corrida");
+    assert!(host.code == CODE_IMAGE_ABSENT || host.code == CODE_IMAGE_REFUSED);
+    let _ = fs::remove_dir_all(empty);
+    let _ = fs::remove_dir_all(with_tool);
+}
diff --git a/crates/archmaker-core/src/contract.rs b/crates/archmaker-core/src/contract.rs
index 6b375e0..213ce2a 100644
--- a/crates/archmaker-core/src/contract.rs
+++ b/crates/archmaker-core/src/contract.rs
@@ -1,12 +1,17 @@
 //! Application-contract verifier (ADR-0011).
 //!
 //! Semantic authority for CLAUSE-* compliance. Does not spawn shell, pacstrap,
-//! mkarchiso or require network. Image format is not admitted: CLAUSE-BOOT-001
-//! cannot be satisfied.
+//! mkarchiso or require network. The live profile target names packages; it is
+//! not an image. Image bytes stay unadmitted: CLAUSE-BOOT-001 cannot be satisfied.
 
 use serde_json::Value;
 
-const ADMITTED_FORMATS: &[&str] = &["archmaker-profile", "archinstall-profile", "report"];
+const ADMITTED_FORMATS: &[&str] = &[
+    "archmaker-profile",
+    "archinstall-profile",
+    "report",
+    "archmaker-live-profile",
+];
 const ALLOWED_OPERATOR_FORMS: &[&str] = &["gt-count", "required", "eq", "info-count"];
 const REQUIRED_CLAUSE_IDS: &[&str] = &[
     "CLAUSE-BASE-001",
diff --git a/crates/archmaker-core/src/core.rs b/crates/archmaker-core/src/core.rs
index 06070b8..365a4f1 100644
--- a/crates/archmaker-core/src/core.rs
+++ b/crates/archmaker-core/src/core.rs
@@ -87,7 +87,16 @@ fn draft_domain_for(schema_version: &str) -> Result<&'static str> {
 }
 
 const DRAFT_TARGETS: [&str; 1] = ["arch-x86_64"];
-const EXPORT_TARGETS: [&str; 3] = ["archmaker-profile", "archinstall-profile", "report"];
+const EXPORT_TARGETS: [&str; 4] = [
+    "archmaker-profile",
+    "archinstall-profile",
+    "report",
+    "archmaker-live-profile",
+];
+const LIVE_PROFILE_TARGET: &str = "archmaker-live-profile";
+const LIVE_BASE_DESCRIPTION: &str = "derivada de Arch Linux";
+const LIVE_DIGEST_PREFIX_LEN: usize = 12;
+const NON_REDISTRIBUTABLE_TAG: &str = "no-redistribuible-candidato";
 
 const PRODUCER_ID: &str = "archmaker-core";
 const PRODUCER_VERSION: &str = "0.1.0";
@@ -1063,12 +1072,139 @@ fn render_report(manifest: &Manifest, target: &TargetRef) -> Result<RenderedArti
     })
 }
 
+fn catalog_option<'a>(
+    catalog: &'a Catalog,
+    option_id: &str,
+) -> Option<&'a archmaker_domain::CatalogOption> {
+    catalog.steps.iter().find_map(|step| {
+        step.sections
+            .iter()
+            .find_map(|section| section.options.iter().find(|option| option.id == option_id))
+    })
+}
+
+fn package_name_is_profile_safe(name: &str) -> bool {
+    let mut chars = name.chars();
+    match chars.next() {
+        Some(first) if first.is_ascii_lowercase() || first.is_ascii_digit() => {}
+        _ => return false,
+    }
+    name.chars()
+        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || matches!(c, '+' | '.' | '_' | '-'))
+        && !name.contains("pacstrap")
+        && !name.contains("cmd")
+}
+
+fn live_public_filename(content_digest: &str) -> String {
+    let prefix: String = content_digest
+        .chars()
+        .take(LIVE_DIGEST_PREFIX_LEN)
+        .collect();
+    format!("Forge-{prefix}-x86_64.iso")
+}
+
+fn profiledef_sh(version_prefix: &str) -> String {
+    format!(
+        "arch=\"x86_64\"\niso_name=\"Forge\"\niso_application=\"{LIVE_BASE_DESCRIPTION}\"\niso_version=\"{version_prefix}\"\ninstall_dir=\"forge\"\n"
+    )
+}
+
+/// Perfil archiso (`packages.x86_64` + `profiledef.sh`) desde el manifiesto y el catálogo.
+/// No importa archiso ni ejecuta `mkarchiso`.
+pub fn render_live_profile(
+    manifest: &Manifest,
+    catalog: &Catalog,
+    target: &TargetRef,
+) -> Result<RenderedArtifact> {
+    let source = CoreOp::ExportArtifact.source();
+    if target.id != LIVE_PROFILE_TARGET {
+        return Err(CoreError::tgt_unsupported(source));
+    }
+    let mut install: BTreeSet<String> = BTreeSet::new();
+    let mut deferred: BTreeSet<String> = BTreeSet::new();
+    for selection in &manifest.effective_selections {
+        let Some(option) = catalog_option(catalog, &selection.option_id) else {
+            continue;
+        };
+        let Some(provider) = option.provider.as_ref() else {
+            continue;
+        };
+        if provider.status != ProviderStatus::Verified {
+            continue;
+        }
+        if !package_name_is_profile_safe(&provider.package_id) {
+            return Err(CoreError::schema_invalid(source));
+        }
+        let non_redistributable = option
+            .tags
+            .as_ref()
+            .is_some_and(|tags| tags.iter().any(|tag| tag == NON_REDISTRIBUTABLE_TAG));
+        if non_redistributable {
+            deferred.insert(provider.package_id.clone());
+        } else {
+            install.insert(provider.package_id.clone());
+        }
+    }
+    for name in &deferred {
+        install.remove(name);
+    }
+    if install.is_empty() {
+        return Err(CoreError::res_unresolved(source));
+    }
+    let packages_x86_64 = install
+        .iter()
+        .map(|name| format!("{name}\n"))
+        .collect::<String>();
+    let prefix: String = manifest
+        .content_digest
+        .value
+        .chars()
+        .take(LIVE_DIGEST_PREFIX_LEN)
+        .collect();
+    let profiledef = profiledef_sh(&prefix);
+    let public_filename = live_public_filename(&manifest.content_digest.value);
+    if public_filename.contains("Arch") || public_filename.starts_with("ARCH") {
+        return Err(CoreError::tgt_unsupported(source));
+    }
+    let forbidden = ["pacstrap", "cmd", "airootfs/"];
+    for text in [&packages_x86_64, &profiledef, &public_filename] {
+        if forbidden.iter().any(|token| text.contains(token)) {
+            return Err(CoreError::schema_invalid(source));
+        }
+    }
+    let envelope = serde_json::json!({
+        "adapter": LIVE_PROFILE_TARGET,
+        "version": target.version,
+        "arch": "x86_64",
+        "baseDescription": LIVE_BASE_DESCRIPTION,
+        "publicFilename": public_filename,
+        "manifestRef": {
+            "contentDigest": {
+                "algorithm": "sha256",
+                "value": manifest.content_digest.value,
+                "kind": "content",
+            }
+        },
+        "files": {
+            "packages.x86_64": packages_x86_64,
+            "profiledef.sh": profiledef,
+        },
+        "deferredFetch": deferred.into_iter().collect::<Vec<_>>(),
+    });
+    Ok(RenderedArtifact {
+        bytes: archmaker_canonicalization::canonicalize(&envelope),
+        media_type: "application/json".to_string(),
+        content: envelope,
+    })
+}
+
 pub fn render_artifact_bytes(manifest: &Manifest, target: &TargetRef) -> Result<RenderedArtifact> {
     let source = CoreOp::ExportArtifact.source();
     match target.id.as_str() {
         "archmaker-profile" => render_archmaker_profile(manifest),
         "archinstall-profile" => render_archinstall_profile(manifest, target),
         "report" => render_report(manifest, target),
+        LIVE_PROFILE_TARGET => Err(CoreError::tgt_unsupported(source)),
         _ => Err(CoreError::tgt_unsupported(source)),
     }
 }
@@ -1377,7 +1513,12 @@ impl CorePort for RealCore {
         if recomputed.value != input.manifest.content_digest.value {
             return Err(CoreError::doc_canonical(source));
         }
-        let rendered = render_artifact_bytes(&input.manifest, &input.target_ref)?;
+        let rendered = if input.target_ref.id == LIVE_PROFILE_TARGET {
+            self.ensure_catalog_match(&input.manifest.catalog_ref, source)?;
+            render_live_profile(&input.manifest, &self.catalog_embedded, &input.target_ref)?
+        } else {
+            render_artifact_bytes(&input.manifest, &input.target_ref)?
+        };
         let binary = BinaryDigest {
             algorithm: DigestAlgorithm::Sha256,
             value: sha256_hex(&rendered.bytes),
diff --git a/crates/archmaker-core/src/lib.rs b/crates/archmaker-core/src/lib.rs
index 04b6779..1f275a0 100644
--- a/crates/archmaker-core/src/lib.rs
+++ b/crates/archmaker-core/src/lib.rs
@@ -35,8 +35,8 @@ pub fn migrate_draft_v1_to_v2_report(
 pub use archmaker_rules::Diagnostic as RuleDiagnostic;
 pub use core::{
     catalog_content_digest, draft_content_digest, is_uuid, manifest_content_digest, new_uuid_v4,
-    new_uuid_v4_wasm_safe, render_artifact_bytes, RealCore, RenderedArtifact, DESKTOP_CATALOG_JSON,
-    EMBEDDED_CATALOG_JSON, PIPELINE_VERSION,
+    new_uuid_v4_wasm_safe, render_artifact_bytes, render_live_profile, RealCore, RenderedArtifact,
+    DESKTOP_CATALOG_JSON, EMBEDDED_CATALOG_JSON, PIPELINE_VERSION,
 };
 pub use error::{CoreError, ErrorCategory, ErrorFamily, Result, Severity};
 pub use inputs::{
diff --git a/crates/archmaker-core/tests/f0_findings.rs b/crates/archmaker-core/tests/f0_findings.rs
index 649b444..31041ea 100644
--- a/crates/archmaker-core/tests/f0_findings.rs
+++ b/crates/archmaker-core/tests/f0_findings.rs
@@ -249,8 +249,12 @@ fn c03_resolve_hostname_encrypt_preserved_as_intention() {
     let face = read_repo("apps/web/src/draft-for-core.ts");
     assert!(face.contains("STEP_IDS.intent"));
     assert!(
-        !face.contains("STEP_IDS.hostname") && !face.contains("STEP_IDS.encrypt"),
-        "draftForCore no quita hostname ni encrypt"
+        !face.contains("STEP_IDS.hostname"),
+        "draftForCore no quita hostname"
+    );
+    assert!(
+        face.contains("STEP_IDS.encrypt") && face.contains("storagePlan"),
+        "la cara no entrega cifrado ni plan de disco al motor"
     );
     let app = read_repo("apps/web/src/App.tsx");
     assert!(
@@ -373,7 +377,14 @@ fn c05_persist_has_typed_save_states_and_serialized_writes() {
 fn c06_export_capability_scoped_save_only() {
     // F5: guardado nativo acotado; sin dialog.json/picker.json ni FS global.
     let app = read_repo("apps/web/src/App.tsx");
-    assert!(app.contains("deliverArtifact("));
+    assert!(
+        app.contains("requestLiveImage"),
+        "Revisión pide la imagen por la operación tipada"
+    );
+    assert!(
+        !app.contains("deliverArtifact("),
+        "pedir imagen no abre el diálogo de guardado"
+    );
     let delivery = read_repo("apps/web/src/export-delivery.ts");
     assert!(delivery.contains("save_export_bytes"));
     assert!(delivery.contains("confirmedSaveOutcome") || delivery.contains("file-saved"));
diff --git a/crates/archmaker-core/tests/iso02_live_profile.rs b/crates/archmaker-core/tests/iso02_live_profile.rs
new file mode 100644
index 0000000..31d2b2b
--- /dev/null
+++ b/crates/archmaker-core/tests/iso02_live_profile.rs
@@ -0,0 +1,170 @@
+//! ISO-02: perfil vivo desde el manifiesto sellado. Sin mkarchiso.
+
+use archmaker_core::{
+    render_live_profile, BuildManifestInput, CorePort, CreateDraftInput, DestinationHandle,
+    ExportArtifactInput, RealCore,
+};
+use archmaker_domain::{Selection, SelectionValue, TargetRef, ONLYOFFICE_CANONICAL_ID};
+
+fn draft_target() -> TargetRef {
+    TargetRef {
+        id: "arch-x86_64".to_string(),
+        version: "2026.10.0".to_string(),
+    }
+}
+
+fn live_target() -> TargetRef {
+    TargetRef {
+        id: "archmaker-live-profile".to_string(),
+        version: "0.1.0".to_string(),
+    }
+}
+
+fn single(step: &str, option: &str) -> Selection {
+    Selection {
+        step_id: step.to_string(),
+        value: SelectionValue::Single {
+            option_id: option.to_string(),
+        },
+    }
+}
+
+fn base_draft(core: &RealCore) -> archmaker_domain::Draft {
+    let mut draft = core
+        .create_draft(CreateDraftInput {
+            draft_id: None,
+            catalog_ref: core.active_catalog_ref().expect("catalog"),
+            target_ref: draft_target(),
+            preset_ref: None,
+            request_id: None,
+        })
+        .expect("create");
+    draft.selections = vec![
+        single("archmaker.base.kernel", "archmaker.kernel.linux"),
+        single(
+            "archmaker.environment.compositor",
+            "archmaker.compositor.gnome",
+        ),
+    ];
+    draft
+}
+
+fn seal(core: &RealCore, draft: archmaker_domain::Draft) -> archmaker_domain::Manifest {
+    core.build_manifest(BuildManifestInput {
+        draft,
+        catalog_ref: core.active_catalog_ref().expect("catalog"),
+        target_ref: live_target(),
+        expected_resolution_digest: None,
+        request_id: None,
+    })
+    .expect("sella")
+}
+
+fn export_bytes(core: &RealCore, manifest: archmaker_domain::Manifest) -> Vec<u8> {
+    core.export_artifact(ExportArtifactInput {
+        manifest,
+        target_ref: live_target(),
+        destination: DestinationHandle::new("live-profile".to_string()).expect("token"),
+        request_id: None,
+    })
+    .expect("export")
+    .bytes
+    .expect("bytes")
+}
+
+#[test]
+fn iso02_same_manifest_same_bytes_without_pacstrap_or_cmd() {
+    let core = RealCore::with_desktop().expect("desktop");
+    let manifest = seal(&core, base_draft(&core));
+    let first = export_bytes(&core, manifest.clone());
+    let second = export_bytes(&core, manifest.clone());
+    assert_eq!(first, second);
+
+    let rendered = render_live_profile(&manifest, core.catalog(), &live_target()).expect("render");
+    assert_eq!(rendered.bytes, first);
+
+    let text = String::from_utf8(first.clone()).expect("utf8");
+    assert!(!text.contains("pacstrap"));
+    assert!(!text.contains("cmd"));
+    assert!(!text.contains("airootfs/"));
+    let value: serde_json::Value = serde_json::from_slice(&first).expect("json");
+    assert_eq!(value["adapter"], "archmaker-live-profile");
+    assert_eq!(value["baseDescription"], "derivada de Arch Linux");
+    assert_eq!(value["arch"], "x86_64");
+    let filename = value["publicFilename"].as_str().expect("filename");
+    assert!(filename.starts_with("Forge-"));
+    assert!(filename.ends_with("-x86_64.iso"));
+    assert!(!filename.contains("Arch"));
+    assert!(!filename.starts_with("ARCH"));
+    let packages = value["files"]["packages.x86_64"]
+        .as_str()
+        .expect("packages");
+    assert_eq!(packages, "gnome-shell\nlinux\n");
+    let profiledef = value["files"]["profiledef.sh"]
+        .as_str()
+        .expect("profiledef");
+    assert!(profiledef.contains("arch=\"x86_64\""));
+    assert!(profiledef.contains("derivada de Arch Linux"));
+    assert_eq!(
+        value["deferredFetch"].as_array().expect("deferred").len(),
+        0
+    );
+}
+
+#[test]
+fn iso02_non_redistributable_is_named_deferred_not_installed() {
+    let core = RealCore::with_desktop().expect("desktop");
+    let mut draft = base_draft(&core);
+    draft.selections.push(Selection {
+        step_id: "archmaker.libpacks.office".to_string(),
+        value: SelectionValue::Multiple {
+            option_ids: vec![ONLYOFFICE_CANONICAL_ID.to_string()],
+        },
+    });
+    let manifest = seal(&core, draft);
+    let bytes = export_bytes(&core, manifest);
+    let value: serde_json::Value = serde_json::from_slice(&bytes).expect("json");
+    let packages = value["files"]["packages.x86_64"]
+        .as_str()
+        .expect("packages");
+    assert!(!packages.contains("onlyoffice-bin"));
+    assert!(!packages.contains("airootfs/"));
+    let deferred = value["deferredFetch"].as_array().expect("deferred");
+    assert_eq!(deferred.len(), 1);
+    assert_eq!(deferred[0], "onlyoffice-bin");
+}
+
+#[test]
+fn iso02_blocking_manifest_yields_no_profile() {
+    let core = RealCore::with_desktop().expect("desktop");
+    let mut draft = base_draft(&core);
+    draft.selections.clear();
+    let error = core
+        .build_manifest(BuildManifestInput {
+            draft,
+            catalog_ref: core.active_catalog_ref().expect("catalog"),
+            target_ref: live_target(),
+            expected_resolution_digest: None,
+            request_id: None,
+        })
+        .expect_err("bloqueado");
+    assert_eq!(error.code, "AM-RES-002");
+}
+
+#[test]
+fn iso02_unknown_target_still_rejected() {
+    let core = RealCore::with_desktop().expect("desktop");
+    let manifest = seal(&core, base_draft(&core));
+    let error = core
+        .export_artifact(ExportArtifactInput {
+            manifest,
+            target_ref: TargetRef {
+                id: "iso".to_string(),
+                version: "0.1.0".to_string(),
+            },
+            destination: DestinationHandle::new("nope".to_string()).expect("token"),
+            request_id: None,
+        })
+        .expect_err("iso");
+    assert_eq!(error.code, "AM-TGT-001");
+}
diff --git a/crates/archmaker-core/tests/negative_capabilities.rs b/crates/archmaker-core/tests/negative_capabilities.rs
index 8415629..9565c87 100644
--- a/crates/archmaker-core/tests/negative_capabilities.rs
+++ b/crates/archmaker-core/tests/negative_capabilities.rs
@@ -130,6 +130,7 @@ fn neg_capability_deny_by_default() {
         "export_artifact",
         "import_draft",
         "save_export_bytes",
+        "constitute_image",
         "inspect_host_hardware",
         "inspect_storage_devices",
         "refresh_storage_snapshot",
@@ -153,10 +154,11 @@ fn neg_capability_deny_by_default() {
         .expect("permissions debe ser lista");
     assert_eq!(
         perms.len(),
-        16,
-        "main: 9 CorePort + allow-save-export-bytes + 6 hardware-inspect (sin shell/FS)"
+        17,
+        "main: 9 CorePort + allow-save-export-bytes + allow-constitute-image + 6 hardware-inspect (sin shell/FS)"
     );
     let mut has_scoped_save = false;
+    let mut has_constitute = false;
     for p in perms {
         let s = p.as_str().expect("permission string");
         assert!(
@@ -170,11 +172,18 @@ fn neg_capability_deny_by_default() {
         if s == "allow-save-export-bytes" {
             has_scoped_save = true;
         }
+        if s == "allow-constitute-image" {
+            has_constitute = true;
+        }
     }
     assert!(
         has_scoped_save,
         "F5 exige allow-save-export-bytes (no diálogo global libre)"
     );
+    assert!(
+        has_constitute,
+        "la imagen se pide con allow-constitute-image, sin shell"
+    );
     assert!(
         !raw.contains("dialog:allow-open")
             && !raw.contains("dialog:default")
@@ -257,6 +266,7 @@ fn neg_web_has_no_remote_or_shell_surface() {
         "build_manifest",
         "export_artifact",
         "import_draft",
+        "constitute_image",
     ] {
         assert!(
             tauri_port.contains(cmd),
@@ -506,6 +516,7 @@ fn neg_allowlist_covers_coreport_plus_scoped_save() {
         "export_artifact",
         "import_draft",
         "save_export_bytes",
+        "constitute_image",
         "inspect_host_hardware",
         "inspect_storage_devices",
         "refresh_storage_snapshot",
@@ -520,7 +531,7 @@ fn neg_allowlist_covers_coreport_plus_scoped_save() {
         count += 1;
     }
     assert_eq!(
-        count, 16,
-        "9 CorePort + save_export_bytes + 6 hardware-inspect"
+        count, 17,
+        "9 CorePort + save_export_bytes + constitute_image + 6 hardware-inspect"
     );
 }
diff --git a/docs/00-governance/decision-register.md b/docs/00-governance/decision-register.md
index 4a566bf..e1939f5 100644
--- a/docs/00-governance/decision-register.md
+++ b/docs/00-governance/decision-register.md
@@ -51,6 +51,7 @@ consumidores referencian los identificadores `DEC-*` y **no** reafirman su estad
 | DEC-010 | Sin telemetría en MVP                                                      | 2026-10-06 | product      | P1        | accepted | no         |
 | DEC-011 | Nombre público Neubat + canal inicial AppImage Linux x86_64                | 2026-10-16 | product      | P0        | accepted | no         |
 | DEC-012 | Nombre visible Forge (GUI) + motor ArchMaker; ids técnicos intactos        | 2026-10-17 | product      | P0        | accepted | no         |
+| DEC-013 | Target `archmaker-live-profile` y proceso de constitución, sin A6          | 2026-10-18 | architecture | P0        | accepted | no         |
 
 ## Registro estructurado
 
@@ -61,9 +62,21 @@ consumidores referencian los identificadores `DEC-*` y **no** reafirman su estad
 - Fecha y autoridad: 2026-10-05 · `product` · `accepted`.
 - ADR: ADR-0003. Requisitos: FR-EXPORT-001, FR-MANIFEST-001. Riesgos: —. Gates: G2, G10.
 - Consecuencia: conjunto de `ExportTarget` fijado (`archmaker-profile`, `archinstall-profile`,
-  `report`).
+  `report`). DEC-013 añade un cuarto id; no borra estos tres.
 - Issue de seguimiento: AUD-016.
 
+### DEC-013 — Perfil vivo y constitución de la imagen
+
+- Pregunta: ¿cómo se amplía el conjunto de export para la imagen viva sin abrir discos?
+- Decisión: target técnico `archmaker-live-profile` y un proceso separado de constitución
+  (descarga tipada y una corrida `mkarchiso`). No es el runner de instalación de ADR-0004.
+- Fecha y autoridad: 2026-10-18 · `architecture` · `accepted`.
+- ADR: ADR-0019. Requisitos: FR-ART-ISO-001, FR-FETCH-001, FR-ISO-001, NFR-MARK-001.
+  Riesgos: RSK-008 (no reabierto: este proceso no eleva). Gates: G2, G4, G8, G10.
+- Consecuencia: el fichero público es `Forge-<prefijo-de-digest>-x86_64.iso` y se describe
+  como derivada de Arch Linux. El contrato de código cambia en ISO-02.
+- Issue de seguimiento: ISO-02.
+
 ### DEC-002 — Ámbito de los identificadores
 
 - Pregunta: ¿ámbito global, por catálogo o por sección?
@@ -191,7 +204,6 @@ consumidores referencian los identificadores `DEC-*` y **no** reafirman su estad
   `RC_SHA` de `main` sin alterar bytes tras el digest.
 - Issue de seguimiento: MVP-6-02, MVP-6-03 (F9).
 
-
 ### DEC-012 — Nombre visible Forge (GUI de ArchMaker)
 
 - Pregunta: ¿qué nombre visible usa la GUI no publicada tras `v0.1.0`, sin alterar la identidad
@@ -210,26 +222,27 @@ consumidores referencian los identificadores `DEC-*` y **no** reafirman su estad
 
 Las únicas desviaciones aceptadas son `DEC-007` y `DEC-008`; ambas se detallan en su registro. El
 resto de decisiones coinciden con la recomendación o la precisan (DEC-005, DEC-006, DEC-009,
-DEC-010, DEC-011, DEC-012).
+DEC-010, DEC-011, DEC-012, DEC-013).
 
 ## Consecuencias aplicadas y no aplicadas
 
-| ID      | Consecuencia                                                         | Estado              | Issue            |
-| ------- | -------------------------------------------------------------------- | ------------------- | ---------------- |
-| DEC-001 | Conjunto de `ExportTarget` fijado en contratos y DTO.                | aplicada            | AUD-016          |
-| DEC-002 | Namespace global `vendor.kind.id`; habilita detección de duplicados. | aplicada            | AUD-011          |
-| DEC-003 | Dominio agnóstico del target; sin `pacstrap`/shell en runtime.       | aplicada            | AUD-016          |
-| DEC-004 | Transporte y elevación fijados; runner v1 diferido a su gate.        | aplicada (diseño)   | AUD-018          |
-| DEC-005 | Licencia Apache-2.0 única en `LICENSE`.                              | aplicada            | AUD-022          |
-| DEC-006 | Firma keyless y verificación offline definidas.                      | parcial (política)  | AUD-019, AUD-022 |
-| DEC-006 | Pipeline real de build/attest/SBOM y firmas.                         | parcial (F9 `v0.1.0`: SBOM/provenance/checksums; cosign local deferred) | AUD-022 |
-| DEC-007 | `THR-UPD-001` cerrado antes de MVP-0.                                | no aplicada         | AUD-019          |
-| DEC-007 | Updater deshabilitado por defecto en builds de desarrollo.           | aplicada            | AUD-019          |
-| DEC-008 | Matriz de soporte y pruebas reducida a x86_64.                       | aplicada            | AUD-020          |
-| DEC-009 | Sin CDN en runtime; CSP `self` y recursos empaquetados.              | aplicada            | AUD-020          |
-| DEC-010 | MVP sin telemetría; solo eventos locales redactados.                 | aplicada            | —                |
-| DEC-011 | Nombre público Neubat; AppImage x86_64 como único canal inicial.     | aplicada (gobierno + release `v0.1.0`) | MVP-6-02/03 (F9) |
-| DEC-012 | Nombre visible Forge; motor ArchMaker; sin renombrar ids técnicos.   | aplicada            | ADR-0012         |
+| ID      | Consecuencia                                                         | Estado                                                                  | Issue            |
+| ------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------- | ---------------- |
+| DEC-001 | Conjunto de `ExportTarget` fijado en contratos y DTO.                | aplicada                                                                | AUD-016          |
+| DEC-002 | Namespace global `vendor.kind.id`; habilita detección de duplicados. | aplicada                                                                | AUD-011          |
+| DEC-003 | Dominio agnóstico del target; sin `pacstrap`/shell en runtime.       | aplicada                                                                | AUD-016          |
+| DEC-004 | Transporte y elevación fijados; runner v1 diferido a su gate.        | aplicada (diseño)                                                       | AUD-018          |
+| DEC-005 | Licencia Apache-2.0 única en `LICENSE`.                              | aplicada                                                                | AUD-022          |
+| DEC-006 | Firma keyless y verificación offline definidas.                      | parcial (política)                                                      | AUD-019, AUD-022 |
+| DEC-006 | Pipeline real de build/attest/SBOM y firmas.                         | parcial (F9 `v0.1.0`: SBOM/provenance/checksums; cosign local deferred) | AUD-022          |
+| DEC-007 | `THR-UPD-001` cerrado antes de MVP-0.                                | no aplicada                                                             | AUD-019          |
+| DEC-007 | Updater deshabilitado por defecto en builds de desarrollo.           | aplicada                                                                | AUD-019          |
+| DEC-008 | Matriz de soporte y pruebas reducida a x86_64.                       | aplicada                                                                | AUD-020          |
+| DEC-009 | Sin CDN en runtime; CSP `self` y recursos empaquetados.              | aplicada                                                                | AUD-020          |
+| DEC-010 | MVP sin telemetría; solo eventos locales redactados.                 | aplicada                                                                | —                |
+| DEC-011 | Nombre público Neubat; AppImage x86_64 como único canal inicial.     | aplicada (gobierno + release `v0.1.0`)                                  | MVP-6-02/03 (F9) |
+| DEC-012 | Nombre visible Forge; motor ArchMaker; sin renombrar ids técnicos.   | aplicada                                                                | ADR-0012         |
+| DEC-013 | Target `archmaker-live-profile`; proceso de constitución sin A6.     | aplicada al target; la cara no ejecuta `mkarchiso`                      | ISO-02           |
 
 ## Reglas de validación (R2)
 
@@ -253,8 +266,9 @@ Equivalencias aplicadas:
 
 ## Historia
 
-Se conservan `DEC-001`..`DEC-012` sin eliminar ninguna. Todas están en estado `accepted`; ninguna
+Se conservan `DEC-001`..`DEC-013` sin eliminar ninguna. Todas están en estado `accepted`; ninguna
 está `superseded`, `rejected` ni `proposed`, por lo que no se declara sucesora. `DEC-005` y
 `DEC-006` fueron aceptadas el 2026-10-05 y **clarificadas** el 2026-10-06. `DEC-009` y `DEC-010`
 pasan de `proposed` a `accepted` el 2026-10-06. `DEC-011` se acepta el 2026-10-16 con ADR-0010
-opción 3 y MVP-6 AppImage. `DEC-012` se acepta el 2026-10-17 con ADR-0012 (Forge).
+opción 3 y MVP-6 AppImage. `DEC-012` se acepta el 2026-10-17 con ADR-0012 (Forge). `DEC-013` se
+acepta el 2026-10-18 con ADR-0019 (perfil vivo; el contrato de código queda para ISO-02).
diff --git a/docs/00-governance/glossary.md b/docs/00-governance/glossary.md
index 97c0f5c..826e25e 100644
--- a/docs/00-governance/glossary.md
+++ b/docs/00-governance/glossary.md
@@ -49,15 +49,15 @@ reviewers:
 
 ## Términos relacionados (no ambiguos, fijados aquí para consistencia)
 
-| Término              | Definición                                                                                                               |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| `SelectionValue`     | Unión discriminada `single`/`multiple`/`boolean`/`number`/`text`/`secretRef`. `secretRef` nunca serializa el secreto.    |
-| `ChangeSet`          | Diferencia explicable entre dos estados de un Draft (manual vs derivado). Producido por `applyPreset`/`compareDrafts`.   |
-| `Diagnostic`         | Resultado tipado y localizado de una etapa de validación. Ver `errors-events.md`.                                        |
-| `CoreError`          | Error estructurado de una operación de `CorePort`. Nunca string libre. Ver `errors-events.md`.                           |
-| `ExportTarget`       | Destino de exportación (`archmaker-profile`, `archinstall-profile`, `report`). Conjunto fijado por **DEC-001**.          |
-| `Evidence` / `Claim` | Afirmación mutable de catálogo con fuente primaria, fecha de captura, verificador y caducidad. Ver `source-register.md`. |
-| `Scope`              | Conjunto mínimo de rutas/permisos concedidos a una capability de Tauri. Ver `tauri-policy.md`.                           |
+| Término              | Definición                                                                                                                          |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| `SelectionValue`     | Unión discriminada `single`/`multiple`/`boolean`/`number`/`text`/`secretRef`. `secretRef` nunca serializa el secreto.               |
+| `ChangeSet`          | Diferencia explicable entre dos estados de un Draft (manual vs derivado). Producido por `applyPreset`/`compareDrafts`.              |
+| `Diagnostic`         | Resultado tipado y localizado de una etapa de validación. Ver `errors-events.md`.                                                   |
+| `CoreError`          | Error estructurado de una operación de `CorePort`. Nunca string libre. Ver `errors-events.md`.                                      |
+| `ExportTarget`       | Destino de exportación. DEC-001 fija `archmaker-profile`, `archinstall-profile` y `report`. DEC-013 añade `archmaker-live-profile`. |
+| `Evidence` / `Claim` | Afirmación mutable de catálogo con fuente primaria, fecha de captura, verificador y caducidad. Ver `source-register.md`.            |
+| `Scope`              | Conjunto mínimo de rutas/permisos concedidos a una capability de Tauri. Ver `tauri-policy.md`.                                      |
 
 ## Vínculos con decisiones
 
diff --git a/docs/00-governance/go-no-go.md b/docs/00-governance/go-no-go.md
index d1ed663..2f93fe6 100644
--- a/docs/00-governance/go-no-go.md
+++ b/docs/00-governance/go-no-go.md
@@ -34,7 +34,7 @@ reviewers:
   (alcance `mvp5-scope.md` accepted: catálogo de matriz, UI de cinco pasos, paridad Tauri/WASM).
 - Reevaluación slice MVP-5 (MVP-5-05): **CONDITIONAL-CLEAR — walking skeleton MVP-0 + slices MVP-1..MVP-5**
   (remediación operativa + Prove-It). Baseline emitida: `implementation-baseline-mvp5`
-  (tags previos intactos). Exclusiones del alcance vigentes (sin runner/ISO).
+  (tags previos intactos). Exclusiones del alcance vigentes hasta el slice ISO-01 de abajo.
 - Post-slice cierre F0–F9 (código en `main` + release): **no** amplía el veredicto al
   runner/ISO. Capas separadas (DOC-DEL-CLO-F8-001 / DOC-DEL-CLO-F9-001): baseline de
   código **passed**; aprobación funcional **pending** (runner F7 estricto y P95 harness
@@ -44,15 +44,19 @@ reviewers:
   install GUI). Ver `docs/10-delivery/closure/f8-governance.md` y `f9-release.md`.
 - Post P0–P6 (cierre ArchMaker/Forge): nomenclatura ADR-0012, integridad de evidencia,
   P95 web, Archify AS_BUILT, aceptación web y desktop/offline **blocked** (P6) documentados
-  en `docs/10-delivery/closure/`. Sin ampliar veredicto a runner/ISO ni publicar un tag nuevo.
+  en `docs/10-delivery/closure/`. Ese cierre no publica un tag nuevo ni abre el runner de instalación.
 - Alcance autorizado: `docs/10-delivery/walking-skeleton.md` (DOC-DEL-WSK-001),
   `docs/10-delivery/mvp1-scope.md` (DOC-DEL-MVP1-001), `docs/10-delivery/mvp2-scope.md`
   (DOC-DEL-MVP2-001), `docs/10-delivery/mvp3-scope.md` (DOC-DEL-MVP3-001),
   `docs/10-delivery/mvp4-scope.md` (DOC-DEL-MVP4-001), `docs/10-delivery/mvp5-scope.md`
   (DOC-DEL-MVP5-001) y empaquetado AppImage de `docs/10-delivery/mvp6-scope.md`
-  (DOC-DEL-MVP6-001, solo esa plataforma). Bloqueados: runner real, root, discos, shell
-  arbitraria, catálogos remotos, firma criptográfica de catálogo en carga, Enterprise, ISO,
-  `.deb`/`.rpm`/OBS/AUR binario como Done de MVP-6.
+  (DOC-DEL-MVP6-001, solo esa plataforma). Slice **ISO-01** (2026-10-18, ADR-0019 / DEC-013,
+  `iso-scope.md` accepted): perfil archiso desde el manifiesto sellado, una corrida
+  `mkarchiso` en proceso separado de constitución, y arranque vivo UEFI x86_64. La
+  instalación en SSD es prueba de archinstall en esa sesión, no escritura de Forge.
+  Bloqueados: runner de instalación (ADR-0004), root, escritura en discos (A6), shell
+  arbitraria, catálogos remotos, firma criptográfica de catálogo en carga, Enterprise,
+  aarch64, `.deb`/`.rpm`/OBS/AUR binario como Done de MVP-6.
 
 ## Motivo del resultado mecánico
 
@@ -126,9 +130,15 @@ los slices **MVP-1** (`mvp1-scope.md`), **MVP-2** (`mvp2-scope.md`), **MVP-3**
 nombre visible vigente **Forge** por ADR-0012 / DEC-012). Alcance **adicional**
 declarativo/sonda (ADR-0013…0018, `forge-declarative-scope.md`): planificación y
 observación de solo lectura; **no** reescribe MVP-5 como permiso de ejecución.
-**No** autorizado: runner real, root, escritura en discos (A6), shell arbitraria,
-catálogos remotos, firma criptográfica de catálogo en carga, Enterprise, ISO, ni
-`.deb`/`.rpm`/OBS/AUR binario como Done.
+**Autorizado además, solo ISO-01:** perfil `archmaker-live-profile`, una corrida
+`mkarchiso` fuera de la cara y el arranque vivo UEFI x86_64 (ADR-0019 / DEC-013).
+El botón de Revisión pide la imagen con una operación tipada: no ejecuta shell ni
+`mkarchiso`. La ISO del 2026-10-18 se generó en una VM, no desde el WebView. Sin la
+línea de este párrafo no había exporter ni `mkarchiso`.
+**No** autorizado: runner de instalación, root, escritura en discos (A6), shell
+arbitraria, catálogos remotos, firma criptográfica de catálogo en carga, Enterprise,
+aarch64, ni `.deb`/`.rpm`/OBS/AUR binario como Done. `mvp5-scope.md` no se reabre.
+`forge-declarative-scope.md` permanece con `executionStatus=not-executed`.
 
 La presencia de F0–F8 en `main` y la publicación F9 (`v0.1.0`) **no** equivalen a
 aprobación funcional firmada ni a `RC_SHA_FUNCIONAL`. El acto de gobierno F8/DEC-011
diff --git a/docs/00-governance/plan-status.md b/docs/00-governance/plan-status.md
index 403db6a..5d43ac3 100644
--- a/docs/00-governance/plan-status.md
+++ b/docs/00-governance/plan-status.md
@@ -16,7 +16,7 @@ reviewers:
 # Estado de planificación
 
 - Estado: in-review
-- Gate global: CONDITIONAL-CLEAR — walking skeleton MVP-0 + slices MVP-1..MVP-5 (sin runner)
+- Gate global: CONDITIONAL-CLEAR — walking skeleton MVP-0 + slices MVP-1..MVP-5, más el slice ISO-01 de imagen viva (sin runner de instalación)
 - Baseline vigente: `implementation-baseline-mvp5` (predecesores mvp0.1..mvp4 intactos)
 - Alcance MVP-5 `accepted` y cerrado (MVP-5-01..05): `docs/10-delivery/mvp5-scope.md`. Hueco residual: `docs/10-delivery/mvp5-gap-spec.md` (draft).
 - Remediación operativa cerrada (transportes reales, ACL, ciclo de edición, exportación, Prove-It): `docs/10-delivery/remediation/`; notas en `acceptance-notes.md`.
@@ -25,20 +25,22 @@ reviewers:
 - Canal de distribución: AppImage Linux x86_64; tag
   [`v0.1.0`](https://github.com/Alexendros/archmaker/releases/tag/v0.1.0) publicó
   nombre histórico del artefacto `v0.1.0` (ADR-0010 / DEC-011; ver `f9-release.md`); nombre visible vigente **Forge** (ADR-0012).
-  (`RC_SHA` `9297ed7…`; `docs/10-delivery/closure/f9-release.md`). ISO / runner /
+  (`RC_SHA` `9297ed7…`; `docs/10-delivery/closure/f9-release.md`). ISO-01
+  (`iso-scope.md`, ADR-0019 / DEC-013) está `accepted` solo para imagen viva x86_64 UEFI;
+  el target `archmaker-live-profile` está en el árbol. La cara no invoca `mkarchiso`. El runner de instalación y
   Enterprise siguen sin `accepted`. Evidencia y `APPROVAL_RECORD` fuera del árbol.
 - Limitaciones v0.1.0: sin cosign local verificado; sin 3× install GUI; F7 sin
   `RC_SHA_FUNCIONAL`; sin imagen Arch. R2: `releaseStatus` del doc F9 = `ineligible`
   (verification parcial).
-- Fecha de corte: 2026-10-17
+- Fecha de corte: 2026-10-18
 
 ## Tres capas (no equiparar)
 
-| Capa                 | Estado    | Nota                                                                                          |
-| -------------------- | --------- | --------------------------------------------------------------------------------------------- |
-| Baseline de código   | passed    | Tag MVP-5 + F0–F8 en `main`                                                                   |
+| Capa                 | Estado    | Nota                                                                                                              |
+| -------------------- | --------- | ----------------------------------------------------------------------------------------------------------------- |
+| Baseline de código   | passed    | Tag MVP-5 + F0–F8 en `main`                                                                                       |
 | Aprobación funcional | pending   | F7 estricto + P95 web en árbol; desktop/offline **blocked** (P6); sin `RC_SHA_FUNCIONAL` ni revisor independiente |
-| Release binaria      | published | AppImage `v0.1.0` (`59246f08…`); verificación parcial (cosign/GUI); ver `f9-release.md` |
+| Release binaria      | published | AppImage `v0.1.0` (`59246f08…`); verificación parcial (cosign/GUI); ver `f9-release.md`                           |
 
 Detalle y residuales: `docs/10-delivery/closure/f8-governance.md`.
 Candidato tip post-P0–P7 (sin publicar): `docs/10-delivery/closure/release-candidate.md`
diff --git a/docs/02-architecture/adr/ADR-0019-perfil-vivo-archiso.md b/docs/02-architecture/adr/ADR-0019-perfil-vivo-archiso.md
new file mode 100644
index 0000000..6a013cb
--- /dev/null
+++ b/docs/02-architecture/adr/ADR-0019-perfil-vivo-archiso.md
@@ -0,0 +1,117 @@
+---
+id: ADR-0019
+phase: v1
+priority: P0
+documentStatus: accepted
+approvalStatus: approved
+implementationStatus: not-started
+verificationStatus: not-verified
+releaseStatus: ineligible
+owners:
+  - architecture
+reviewers:
+  - independent-reviewer
+dependsOn:
+  - id: ADR-0003
+    expectedDocumentStatus: accepted
+  - id: ADR-0004
+    expectedDocumentStatus: accepted
+  - id: ADR-0010
+    expectedDocumentStatus: accepted
+  - id: ADR-0012
+    expectedDocumentStatus: accepted
+---
+
+# ADR-0019: Target de perfil vivo y proceso de constitución
+
+- Estado: accepted
+- Fecha: 2026-10-18
+- Aceptación: 2026-10-18
+- Propietario: Arquitectura
+- Requisitos: FR-ART-ISO-001, FR-FETCH-001, FR-ISO-001, NFR-MARK-001, NFR-SEC-001, NFR-OFF-001
+- Decisiones: DEC-001, DEC-003, DEC-004, DEC-008, DEC-012, DEC-013
+
+## Contexto
+
+DEC-001 fija tres targets de export: `archmaker-profile`, `archinstall-profile` y `report`.
+`docs/10-delivery/iso-scope.md` (ISO-01, aceptado el 2026-10-18) pide un cuarto target para el
+perfil archiso de una imagen viva x86_64 UEFI, y prohíbe ampliar ese conjunto en silencio.
+
+ADR-0004 describe el runner de instalación: proceso separado, operaciones allowlisted, elevación
+fuera del WebView, capaz de un plan destructivo. Ese runner sigue cerrado (A6, root, discos,
+shell arbitraria). La constitución de la imagen no es ese runner.
+
+ADR-0010 y ADR-0012 fijan la marca. El fichero que descarga una persona no puede presentarse
+como Arch Linux ni empezar por el signo ARCH. El nombre visible vigente es Forge.
+
+## Drivers
+
+- FR-ART-ISO-001: el manifiesto sellado produce `packages.x86_64` y `profiledef.sh`.
+- FR-ISO-001: una corrida de `mkarchiso` y un digest ligado a ese manifiesto.
+- NFR-SEC-001: el WebView no ejecuta shell ni root.
+- NFR-OFF-001: sin red, el configurador sigue usable.
+- DEC-008: el host de la imagen es Arch x86_64. aarch64 queda fuera.
+- No reimplementar archiso ni importarlo desde el dominio Rust (ADR-0003).
+
+## Opciones
+
+1. Añadir el target dentro de `archmaker-core` llamando a `mkarchiso` desde el export.
+2. Reabrir el runner de instalación de ADR-0004 para que también construya la imagen.
+3. Añadir un target de perfil y un proceso de constitución distinto, con argv fijo y sin
+   privilegio de disco.
+
+## Decisión
+
+Se adopta la opción 3 (2026-10-18, autoridad `architecture`, DEC-013).
+
+| Ámbito                 | Valor                                                                                         |
+| ---------------------- | --------------------------------------------------------------------------------------------- |
+| Id técnico del target  | `archmaker-live-profile`                                                                      |
+| Targets previos        | Siguen válidos. DEC-001 no se borra.                                                          |
+| Fichero público        | `Forge-<prefijo-de-digest>-x86_64.iso`                                                        |
+| Descripción de la base | «derivada de Arch Linux»                                                                      |
+| Contenido del target   | `packages.x86_64` (un nombre por línea) y `profiledef.sh` con `arch=x86_64`                   |
+| Prohibido en el perfil | `pacstrap`, strings `cmd`, copia de binarios no redistribuibles a `airootfs/`                 |
+| Proceso                | Binario separado de constitución. No es el runner de instalación.                             |
+| Operaciones            | Descarga tipada del conjunto del perfil, y una corrida de `mkarchiso`                         |
+| Argv de `mkarchiso`    | Fijo: el binario externo y el directorio del perfil sellado. Sin script del operador.         |
+| Botón de Revisión      | Pide `constitute_image`. No abre un shell ni ejecuta `mkarchiso`.                             |
+| Sin red                | La cara sigue usable. La constitución falla con error tipado.                                 |
+| Discos                 | Este proceso no particiona, no formatea y no escribe el disco del operador ni el del destino. |
+
+El id técnico no es el nombre del fichero. El dominio Rust no enlaza archiso. El contrato de
+código (`EXPORT_TARGETS`, schemas y `dto.md`) cambia en ISO-02, no en este corte documental.
+
+La instalación en un SSD de prueba la hace archinstall dentro de la sesión viva. Forge no la
+ejecuta.
+
+## Consecuencias
+
+- ISO-02 puede añadir `archmaker-live-profile` al contrato. Hasta ese cambio, exportar ese id
+  sigue rechazado.
+- ISO-03 y ISO-04 implementan el proceso. Si el host no tiene `mkarchiso`, la corrida queda
+  `blocked` o `not_run`. No se fabrica una imagen de sustitución.
+- ADR-0004 no se enmienda para autorizar escritura en discos.
+- `executionStatus` de los planes de disco permanece `not-executed`. A6 no se reabre.
+
+## Riesgos
+
+- Confundir este proceso con el runner de instalación. Se mitiga con el id de operación y con
+  la ausencia de comandos de disco en su allowlist.
+- Un botón que construya una string de shell. Se mitiga con argv fijo y prueba negativa.
+- Nombre de fichero con marca Arch. Se mitiga con el patrón `Forge-…-x86_64.iso`.
+
+## Verificación
+
+- Golden de ISO-02: mismos bytes, sin `pacstrap` ni `cmd`. Manifiesto bloqueante sin perfil.
+- ISO-03: fixture local; nombre fuera del perfil rechazado; sin red, error tipado.
+- ISO-04: `SHA256SUMS` ligado al manifiesto y arranque UEFI en VM, o `blocked` / `not_run`.
+- El WebView no recibe una string `cmd`.
+
+## Sustituye
+
+—
+
+## Sustituido por
+
+—
diff --git a/docs/02-architecture/adr/README.md b/docs/02-architecture/adr/README.md
index f9c3284..cc7803e 100644
--- a/docs/02-architecture/adr/README.md
+++ b/docs/02-architecture/adr/README.md
@@ -46,6 +46,7 @@ Propietario, Requisitos) y las secciones de `templates/adr.md`. Estados posibles
 | [ADR-0016](ADR-0016-contratos-digest-v2.md)                            | Contratos y digests schemaVersion 2                  | proposed | 2026-10-17 |
 | [ADR-0017](ADR-0017-navegadores-y-onlyoffice.md)                       | ONLYOFFICE canónico y cardinalidad de navegadores    | proposed | 2026-10-17 |
 | [ADR-0018](ADR-0018-alcance-declarativo-a6-excluida.md)                | Alcance declarativo; A6 excluida                     | proposed | 2026-10-17 |
+| [ADR-0019](ADR-0019-perfil-vivo-archiso.md)                            | Target de perfil vivo y proceso de constitución      | accepted | 2026-10-18 |
 
 ## Crear un ADR
 
diff --git a/docs/04-interfaces/core-port.md b/docs/04-interfaces/core-port.md
index e57cf25..35ca06c 100644
--- a/docs/04-interfaces/core-port.md
+++ b/docs/04-interfaces/core-port.md
@@ -238,20 +238,20 @@ Los adaptadores nunca convierten una operación pura en I/O; Tauri y WASM respet
 
 ### `exportArtifact`
 
-| Aspecto                     | Especificación                                                                                                                                                         |
-| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Request                     | `ExportArtifactInput` (DTO de operación; campos en `dto.md`).                                                                                                          |
-| Response                    | `Artifact` — `artifact.schema.json`.                                                                                                                                   |
-| Precondiciones              | `manifestRef` resuelve a un manifest sellado; `targetRef.id` en `archmaker-profile`, `archinstall-profile`, `report` (DEC-001); `destinationHandle` válido del picker. |
-| Postcondiciones             | Bytes escritos de forma atómica; `binaryDigest` de los bytes exactos; `manifestRef.contentDigest` liga al manifest de origen.                                          |
-| Pureza/IO                   | I/O de escritura acotada; sin red.                                                                                                                                     |
-| Idempotencia                | El mismo manifest y destino producen los mismos bytes y `binaryDigest` (byte-idempotente). El efecto de sobrescritura no es idempotente si el destino lo permite.      |
-| Cancelación y tiempo límite | Cancelable hasta antes del `fsync`; un fallo de `rename` no deja artefacto parcial. Tiempo límite objetivo 30 s.                                                       |
-| Límites                     | Payload `artifact.content` acotado por el adaptador de target; cierre del mapa diferido (SRC-003).                                                                     |
-| Errores                     | `AM-TGT-001`, `AM-IO-001`, `AM-DOC-001`, `AM-SCHEMA-001`.                                                                                                              |
-| Eventos                     | `core.operation.started`, `artifact.created`, `core.operation.completed`.                                                                                              |
-| Redacción                   | `destinationHandle` es un mango opaco; nunca una ruta absoluta. Sin secretos.                                                                                          |
-| Vectores                    | `contracts/json-schema/examples/06-artifact.valid.json`, `06-artifact.invalid.json`; `TST-EXP-001`.                                                                    |
+| Aspecto                     | Especificación                                                                                                                                                                                              |
+| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Request                     | `ExportArtifactInput` (DTO de operación; campos en `dto.md`).                                                                                                                                               |
+| Response                    | `Artifact` — `artifact.schema.json`.                                                                                                                                                                        |
+| Precondiciones              | `manifestRef` resuelve a un manifest sellado; `targetRef.id` en `archmaker-profile`, `archinstall-profile`, `report` (DEC-001) o `archmaker-live-profile` (DEC-013); `destinationHandle` válido del picker. |
+| Postcondiciones             | Bytes escritos de forma atómica; `binaryDigest` de los bytes exactos; `manifestRef.contentDigest` liga al manifest de origen.                                                                               |
+| Pureza/IO                   | I/O de escritura acotada; sin red.                                                                                                                                                                          |
+| Idempotencia                | El mismo manifest y destino producen los mismos bytes y `binaryDigest` (byte-idempotente). El efecto de sobrescritura no es idempotente si el destino lo permite.                                           |
+| Cancelación y tiempo límite | Cancelable hasta antes del `fsync`; un fallo de `rename` no deja artefacto parcial. Tiempo límite objetivo 30 s.                                                                                            |
+| Límites                     | Payload `artifact.content` acotado por el adaptador de target; cierre del mapa diferido (SRC-003).                                                                                                          |
+| Errores                     | `AM-TGT-001`, `AM-IO-001`, `AM-DOC-001`, `AM-SCHEMA-001`.                                                                                                                                                   |
+| Eventos                     | `core.operation.started`, `artifact.created`, `core.operation.completed`.                                                                                                                                   |
+| Redacción                   | `destinationHandle` es un mango opaco; nunca una ruta absoluta. Sin secretos.                                                                                                                               |
+| Vectores                    | `contracts/json-schema/examples/06-artifact.valid.json`, `06-artifact.invalid.json`; `TST-EXP-001`.                                                                                                         |
 
 ## Matriz resumen
 
diff --git a/docs/04-interfaces/dto.md b/docs/04-interfaces/dto.md
index 157354f..d34c5ab 100644
--- a/docs/04-interfaces/dto.md
+++ b/docs/04-interfaces/dto.md
@@ -318,18 +318,18 @@ y hasheado con `domainLabel: archmaker:manifest:v1` (ADR-0007).
 Schema `https://archmaker.dev/schemas/artifact.schema.json`. Declara target, productor, versiones,
 `mediaType` y digests (DEC-001, ADR-0003).
 
-| Campo             | Tipo                      | Oblig. | `$defs`                                   | Notas                                                        |
-| ----------------- | ------------------------- | ------ | ----------------------------------------- | ------------------------------------------------------------ |
-| `documentVersion` | documentVersion           | Sí     | —                                         | —                                                            |
-| `schemaVersion`   | schemaVersion             | Sí     | —                                         | —                                                            |
-| `artifactRef`     | ArtifactRef               | Sí     | `artifact.schema.json#/$defs/artifactRef` | `{ binaryDigest, mediaType }`.                               |
-| `targetRef`       | TargetRef                 | Sí     | —                                         | `id` ∈ `archmaker-profile`, `archinstall-profile`, `report`. |
-| `producer`        | Producer                  | Sí     | `common#/$defs/producer`                  | —                                                            |
-| `mediaType`       | string                    | Sí     | —                                         | IANA.                                                        |
-| `binaryDigest`    | BinaryDigest              | Sí     | `common#/$defs/binaryDigest`              | Bytes exactos.                                               |
-| `manifestRef`     | ManifestRef               | Sí     | `artifact.schema.json#/$defs/manifestRef` | `{ contentDigest }` semántico.                               |
-| `experimental`    | boolean                   | No     | —                                         | `true` para `archinstall-profile`.                           |
-| `content`         | object \| array \| string | No     | —                                         | Mapa abierto definido por el adapter (SRC-003).              |
+| Campo             | Tipo                      | Oblig. | `$defs`                                   | Notas                                                                                            |
+| ----------------- | ------------------------- | ------ | ----------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| `documentVersion` | documentVersion           | Sí     | —                                         | —                                                                                                |
+| `schemaVersion`   | schemaVersion             | Sí     | —                                         | —                                                                                                |
+| `artifactRef`     | ArtifactRef               | Sí     | `artifact.schema.json#/$defs/artifactRef` | `{ binaryDigest, mediaType }`.                                                                   |
+| `targetRef`       | TargetRef                 | Sí     | —                                         | `id` ∈ `archmaker-profile`, `archinstall-profile`, `report`, `archmaker-live-profile` (DEC-013). |
+| `producer`        | Producer                  | Sí     | `common#/$defs/producer`                  | —                                                                                                |
+| `mediaType`       | string                    | Sí     | —                                         | IANA.                                                                                            |
+| `binaryDigest`    | BinaryDigest              | Sí     | `common#/$defs/binaryDigest`              | Bytes exactos.                                                                                   |
+| `manifestRef`     | ManifestRef               | Sí     | `artifact.schema.json#/$defs/manifestRef` | `{ contentDigest }` semántico.                                                                   |
+| `experimental`    | boolean                   | No     | —                                         | `true` para `archinstall-profile`.                                                               |
+| `content`         | object \| array \| string | No     | —                                         | Mapa abierto definido por el adapter (SRC-003).                                                  |
 
 ## Regla de paridad Rust/TypeScript/WASM
 
diff --git a/docs/10-delivery/closure/honest-ux.md b/docs/10-delivery/closure/honest-ux.md
index 8db49e6..213944b 100644
--- a/docs/10-delivery/closure/honest-ux.md
+++ b/docs/10-delivery/closure/honest-ux.md
@@ -21,20 +21,21 @@ dependsOn:
 - Documento: DOC-DEL-CLO-UX-001 · Estado: draft · Propietario: Arquitectura
 - No rediseña la cara Forge. No toca capabilities de Tauri (dueño: F5).
 
-## Seis pasos visibles (`RAIL_STEPS`)
+## Recorrido de la cara
 
-Flujo vigente en `apps/web/src/forge-face.ts` → `RAIL_STEPS` (experiencia única; sin Sencillo/Avanzado):
+Nota 2026-10-18 (orden del operador, ISO-01). El rail de seis pasos, con «Disco y particiones» primero, deja de ser el recorrido. El código de `RAIL_STEPS` se alinea en el task de cara; hasta ese cambio esta tabla es la decisión, no una descripción del binario anterior.
+
+Flujo: Sistema base → Entorno → Apps → Identidad y seguridad → Revisión (experiencia única; sin Sencillo/Avanzado). En Revisión se pide la imagen. No hay paso de disco.
 
 | #   | id                  | Título                |
 | --- | ------------------- | --------------------- |
-| 1   | `storage`           | Disco y particiones   |
-| 2   | `base`              | Sistema base          |
-| 3   | `environment`       | Entorno               |
-| 4   | `apps`              | Apps                  |
-| 5   | `identity-security` | Identidad y seguridad |
-| 6   | `review`            | Revisión              |
-
-Denominador: 6/6. Progreso semántico (`visited` / `complete` / `invalid` / `pending` / `current`); visitar no valida.
+| 1   | `base`              | Sistema base          |
+| 2   | `environment`       | Entorno               |
+| 3   | `apps`              | Apps                  |
+| 4   | `identity-security` | Identidad y seguridad |
+| 5   | `review`            | Revisión              |
+
+Denominador previsto: 5/5. Progreso semántico (`visited` / `complete` / `invalid` / `pending` / `current`); visitar no valida. El mensaje «Archivo guardado» y el gate P6 no son el éxito de este slice.
 
 ## C-07 — tamaño y avisos
 
diff --git a/docs/10-delivery/closure/iso04-mkarchiso-not-run.md b/docs/10-delivery/closure/iso04-mkarchiso-not-run.md
new file mode 100644
index 0000000..5abe2e0
--- /dev/null
+++ b/docs/10-delivery/closure/iso04-mkarchiso-not-run.md
@@ -0,0 +1,64 @@
+---
+id: DOC-DEL-CLO-ISO04-001
+phase: v1
+priority: P0
+documentStatus: draft
+approvalStatus: pending
+implementationStatus: partial
+verificationStatus: partial
+releaseStatus: ineligible
+owners:
+  - release
+reviewers:
+  - independent-reviewer
+dependsOn:
+  - id: DOC-DEL-ISO-001
+    expectedDocumentStatus: accepted
+---
+
+# ISO-04 — corrida en VM y arranque UEFI
+
+## Resultado
+
+La corrida de `mkarchiso` se ejecutó una vez, dentro de una máquina virtual Arch x86_64, porque el host es Ubuntu 26.04 y no tiene `mkarchiso` ni `pacman`. No es un fichero de sustitución. P6 y F7 no cambian. `technicalResult` de cierre de producto no se emite. El arranque UEFI de esta ISO cubre el criterio LiveISO. SSD sigue `not_run`.
+
+| Dato          | Valor                                                              |
+| ------------- | ------------------------------------------------------------------ |
+| Imagen        | `Forge-aaa81a961b0a-x86_64.iso` (1 085 308 928 bytes)              |
+| SHA-256       | `82f5afb1d80b682952ac616e4d52803a8730b6b85ab26a2dfd8c0ea2223d0745` |
+| Manifiesto    | `aaa81a961b0aac65d58bfad91f59f8755935872b5f2996e4cd04e92dbcdca1f0` |
+| Ruta local    | `/home/alexendros/archmaker-iso-build/out/` (fuera del repo)       |
+| `mkarchiso`   | 2026-10-18 20:15:14Z → 20:19:19Z (4 min 5 s), archiso 91           |
+| Arranque UEFI | OVMF, menú `Forge (x86_64, UEFI)`, getty y shell de root           |
+| Tarifa        | 0 USD. Corrida local, no Actions                                   |
+
+`sha256sum -c SHA256SUMS` en el host respondió OK. El nombre no contiene `Arch` y no empieza por `ARCH`. La aplicación de la ISO es «derivada de Arch Linux». xorriso avisó que el volid `FORGE_AAA81A961B0A` pasa de 16 caracteres en Joliet; la imagen se escribió y arrancó.
+
+## Cómo se construyó
+
+VM de construcción: imagen oficial `Arch-Linux-x86_64-basic.qcow2` (SHA-256 `bb888a084568f4e68b1260ffa614ebf806c79668fa20f946c691973538f4d33c`), KVM, 3 GiB, disco virtual de 40 GiB. El perfil sellado del borrador de escritorio aporta `gnome-shell` y `linux`, `iso_name=Forge`, `iso_version=aaa81a961b0a` e `install_dir=forge`. El directorio que recibió `mkarchiso` parte de `/usr/share/archiso/configs/baseline` (modos `bios.syslinux` y `uefi.grub`, que el perfil sellado no trae) y añade `gnome-shell`. La compresión erofs del template bajó de lzma 109 a 6 para caber en la RAM de la VM. El argv fue `mkarchiso -v -w /var/tmp/archiso-work -o /var/tmp/archiso-out /var/tmp/archiso-profile`.
+
+El perfil no contiene `pacstrap` ni `cmd`. El hostname de la sesión viva sigue siendo `archlinux`: lo deja el template baseline. El menú y `/etc/issue` dicen Forge y «derivada de Arch Linux».
+
+## Arranque UEFI
+
+Segunda VM, firmware `/usr/share/OVMF/OVMF_CODE_4M.fd`, la ISO como CD-ROM, serie. El menú resalta `Forge (x86_64, UEFI)`. Tras el arranque, el getty muestra:
+
+```text
+Forge
+derivada de Arch Linux
+archlinux login:
+```
+
+Un segundo arranque entró como root (contraseña vacía del template), ejecutó `echo LIVE_OK` y `cat /etc/issue`, y apagó a los 13 s de kernel (`reboot: Power down`, 2026-10-18 20:22:09Z). No se particionó ningún disco del host.
+
+## Estado tras la corrida
+
+| Caso                    | Estado    | Motivo                                                                                                                                                       |
+| ----------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Botón de Revisión       | cableado  | «Pedir imagen» llama a `requestLiveImage`. En el mock el aviso es `constitution-mkarchiso-absent` (Playwright, 20 pruebas). No arranca la VM ni `mkarchiso`. |
+| LiveISO                 | cubierto  | Orden del operador (2026-10-18): si arranca en VM UEFI, el criterio queda cubierto. Evidencia: OVMF, `LIVE_OK`, digest de esta ISO. No se escribió un USB.   |
+| SSD con archinstall     | `not_run` | El perfil no nombra `archinstall`. No hubo disco de prueba.                                                                                                  |
+| AppImage, tag, `v0.1.0` | no hecho  | Siguen fuera de este plan.                                                                                                                                   |
+
+La ISO no entra en el repositorio. No hay commit de este registro hasta una orden distinta.
diff --git a/docs/10-delivery/iso-scope.md b/docs/10-delivery/iso-scope.md
index a085464..7c588a7 100644
--- a/docs/10-delivery/iso-scope.md
+++ b/docs/10-delivery/iso-scope.md
@@ -2,8 +2,8 @@
 id: DOC-DEL-ISO-001
 phase: v1
 priority: P0
-documentStatus: in-review
-approvalStatus: pending
+documentStatus: accepted
+approvalStatus: approved
 implementationStatus: not-started
 verificationStatus: not-verified
 releaseStatus: ineligible
@@ -19,20 +19,27 @@ dependsOn:
     expectedDocumentStatus: accepted
   - id: DOC-RES-HTML-001
   - id: DOC-GOV-GNG-001
+  - id: ADR-0019
+    expectedDocumentStatus: accepted
 ---
 
 # Alcance de imagen — perfil, descarga y constitución
 
-- Documento: DOC-DEL-ISO-001 · Estado: in-review · Propietario: Arquitectura · Fecha: 2026-10-14
-- Fase de producto: v1. El veredicto vigente no autoriza runner, root, discos ni shell.
-- Aceptar este documento es condición necesaria y no suficiente: hace falta una línea nueva
-  en `docs/00-governance/go-no-go.md` antes de escribir el exporter o llamar a `mkarchiso`.
+- Documento: DOC-DEL-ISO-001 · Estado: accepted · Propietario: Arquitectura · Fecha: 2026-10-14
+- Aceptación: 2026-10-18 (ISO-01). Solo imagen viva x86_64 UEFI.
+- Fase de producto: v1. Este alcance no autoriza root, discos (A6) ni shell arbitraria.
+- La línea de `docs/00-governance/go-no-go.md` (ISO-01) es la compuerta del exporter y de
+  `mkarchiso`. El contrato de código del target llega en ISO-02 (ADR-0019 / DEC-013).
 
 ## Objetivo
 
-Un manifiesto sellado produce un perfil archiso declarativo. Un runner separado, cuando el
-veredicto lo abra, ejecuta una sola corrida de `mkarchiso` y publica el digest. archiso no se
-reimplementa. `pacstrap` no es el constructor. El dominio Rust no importa archiso (ADR-0003).
+Un manifiesto sellado produce un perfil archiso declarativo. Un proceso de constitución,
+distinto del runner de instalación (ADR-0004), ejecuta una sola corrida de `mkarchiso` y
+publica el digest. archiso no se reimplementa. `pacstrap` no es el constructor. El dominio
+Rust no importa archiso (ADR-0003).
+
+La imagen aceptada es la viva x86_64 UEFI. El criterio de arranque se llama LiveISO: si la imagen arranca en una VM UEFI, el criterio queda cubierto. Instalarla en un SSD es prueba
+del archinstall que ya va en esa sesión, no una escritura de Forge. aarch64 sigue fuera.
 
 Estructura de perfil, según <https://wiki.archlinux.org/title/Archiso> y
 `README.profile.rst` del proyecto archiso: `airootfs/`, arranque, `packages.x86_64` (un
@@ -66,7 +73,7 @@ El ahorro está en esa autoría, no en la CPU de la corrida.
 
 ### Datos e interfaces
 
-`DM-MANIFEST`, `DM-ARTIFACT`, target nuevo distinto de `archmaker-profile`, `archinstall-profile` y `report`. El target nuevo no existe en contrato hasta un ADR de export que siga a la aceptación de este alcance. DEC-001 fija el conjunto actual; ampliarlo es parte del issue ISO-01, no un cambio silencioso.
+`DM-MANIFEST`, `DM-ARTIFACT`, target `archmaker-live-profile` (ADR-0019 / DEC-013), distinto de `archmaker-profile`, `archinstall-profile` y `report`. El id técnico no es el nombre del fichero público (`Forge-<prefijo-de-digest>-x86_64.iso`). El match en `EXPORT_TARGETS` es ISO-02; este corte no lo añade.
 
 ### Validación y seguridad
 
@@ -150,7 +157,7 @@ Perfil de FR-ART-ISO-001. Herramienta externa `mkarchiso`, citada y no vendada.
 
 ### Validación y seguridad
 
-La corrida no ocurre en el portátil del operador como efecto de pulsar Exportar. Job aislado. Sin telemetría (DEC-010).
+El botón de Revisión no ejecuta un shell ni llama a `mkarchiso`. Pide la imagen con la operación tipada `constitute_image`, que no recibe ruta ni script. La corrida de `mkarchiso` del 2026-10-18 fue una vez, en una VM, sobre el perfil sellado. El proceso no particiona. Sin telemetría (DEC-010).
 
 ### Pruebas
 
@@ -171,9 +178,9 @@ no se convierte en otro instalador.
 
 | #      | Issue                                                                    | Depende de | Gate        | Owner        | Criterio Done                               |
 | ------ | ------------------------------------------------------------------------ | ---------- | ----------- | ------------ | ------------------------------------------- |
-| ISO-01 | Aceptar este alcance, ADR-0010 y una reevaluación del veredicto          | —          | G2, G8, G10 | product      | `go-no-go.md` nombra el slice               |
+| ISO-01 | Aceptar este alcance, ADR-0019 y una reevaluación del veredicto          | —          | G2, G8, G10 | product      | `go-no-go.md` nombra el slice (2026-10-18)  |
 | ISO-02 | Target de export del perfil, con corpus, sin ampliar DEC-001 en silencio | 01         | G4, G5      | architecture | Golden sin `pacstrap` ni `cmd`              |
 | ISO-03 | Operación de descarga tipada con fixture                                 | 02         | G8          | security     | Rechazo sin red y rechazo de nombres ajenos |
 | ISO-04 | Corrida `mkarchiso` en runner separado y prueba de VM                    | 03         | G10         | release      | Imagen + SHA-256 + arranque UEFI anotado    |
 
-Hasta ISO-01 el producto exporta `archmaker-profile`, el sobre experimental `archinstall-profile` y `report`. No constituye una imagen.
+ISO-01 documental está aceptado. ISO-02 admite el target `archmaker-live-profile` (perfil, no imagen). Siguen los tres targets de DEC-001. ISO-03 descarga ese conjunto desde un fixture local en el proceso `archmaker-constitute`; sin fixture responde `constitution-offline` y no abre red. ISO-04 se ejecutó el 2026-10-18 dentro de una VM Arch x86_64: `Forge-aaa81a961b0a-x86_64.iso`, SHA-256 en `SHA256SUMS`, arranque UEFI hasta el shell de la sesión viva. Ese arranque cubre el criterio LiveISO (orden del operador, 2026-10-18). SSD sigue `not_run`. Registro: [`closure/iso04-mkarchiso-not-run.md`](closure/iso04-mkarchiso-not-run.md). P6 y F7 no se marcan passed.
diff --git a/docs/10-delivery/mvp5-scope.md b/docs/10-delivery/mvp5-scope.md
index fa2c080..d065b2b 100644
--- a/docs/10-delivery/mvp5-scope.md
+++ b/docs/10-delivery/mvp5-scope.md
@@ -70,7 +70,8 @@ Rust. No se construye ISO, no se descarga el espejo y no se llama a pacman.
 ## Criterio de salida
 
 Los issues 01–05 cerrados. Tag `implementation-baseline-mvp5` emitido (MVP-5-05); tags
-MVP-0.1..MVP-4 intactos. Runner e ISO siguen fuera del veredicto.
+MVP-0.1..MVP-4 intactos. Este alcance no autoriza runner ni imagen. El slice de imagen viva
+(ISO-01, 2026-10-18) vive en `go-no-go.md` y no reabre MVP-5.
 
 ## Post-slice (cierre F0–F7 / gobierno F8)
 
diff --git a/docs/10-delivery/mvp6-scope.md b/docs/10-delivery/mvp6-scope.md
index 45994f4..d0f33c1 100644
--- a/docs/10-delivery/mvp6-scope.md
+++ b/docs/10-delivery/mvp6-scope.md
@@ -37,7 +37,7 @@ permite a tarifa de alta cero, sin presentar el producto como Arch Linux oficial
 visible: **Forge** (ADR-0012 / DEC-012; `v0.1.0` publicó Neubat bajo ADR-0010 / DEC-011).
 
 La tienda instala la aplicación. La imagen de instalación de un sistema es otro alcance
-(`docs/10-delivery/iso-scope.md`), sigue sin `accepted`.
+(`docs/10-delivery/iso-scope.md`) está `accepted` solo como imagen viva (ISO-01). Este alcance de empaquetado no la construye.
 
 ## Plataforma autorizada (única)
 
diff --git a/docs/10-delivery/roadmap.md b/docs/10-delivery/roadmap.md
index cc85dec..db15029 100644
--- a/docs/10-delivery/roadmap.md
+++ b/docs/10-delivery/roadmap.md
@@ -32,7 +32,7 @@ PD-0 fuentes; PD-1 producto; PD-2 arquitectura; PD-3 datos; PD-4 interfaces; PD-
   ([`closure/f9-release.md`](closure/f9-release.md)); aprobación funcional F7 **pending**.
 - MVP-6 packaging — [`mvp6-scope.md`](mvp6-scope.md) **accepted** solo AppImage; ADR-0010
   **accepted** (opción 3). Residual: cosign local / 3× GUI; `.deb`/`.rpm`/AUR deferred.
-- Imagen de instalación — alcance v1 en revisión ([`iso-scope.md`](iso-scope.md)); fuera del veredicto vigente.
+- Imagen viva x86_64 UEFI — [`iso-scope.md`](iso-scope.md) **accepted** (ISO-01, 2026-10-18). El veredicto nombra perfil archiso, una corrida `mkarchiso` y arranque vivo. El SSD lo instala archinstall en la sesión. El target `archmaker-live-profile` y la descarga tipada están en el árbol. La corrida de 2026-10-18 produjo `Forge-aaa81a961b0a-x86_64.iso` en una VM y arrancó por UEFI; ese arranque cubre LiveISO. SSD sigue `not_run` ([`closure/iso04-mkarchiso-not-run.md`](closure/iso04-mkarchiso-not-run.md)).
 
 ## v1
 
diff --git a/docs/11-operations/manual/Limites.md b/docs/11-operations/manual/Limites.md
index 4f431ec..8424dc2 100644
--- a/docs/11-operations/manual/Limites.md
+++ b/docs/11-operations/manual/Limites.md
@@ -23,7 +23,7 @@ El MVP es usable sin CDN ni servidor (NFR-OFF-001). El catálogo y los drafts vi
 
 ## Sin instalación del sistema
 
-Forge / ArchMaker (ids técnicos `archmaker*`) no particiona discos, no ejecuta `pacstrap`, no corre hooks ni scripts heredados y no escribe fuera del espacio de la aplicación. La imagen de instalación es otro alcance (`docs/10-delivery/iso-scope.md`), todavía no autorizado.
+Forge / ArchMaker (ids técnicos `archmaker*`) no particiona discos, no ejecuta `pacstrap`, no corre hooks ni scripts heredados y no escribe el disco del operador ni el del destino. La imagen viva está autorizada como alcance (`docs/10-delivery/iso-scope.md`, ISO-01) y todavía no se constituye: el SSD lo instalará archinstall en la sesión viva.
 
 ## Sin ejecución del plan
 
diff --git a/docs/index.md b/docs/index.md
index df9521f..68a3764 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -56,6 +56,7 @@ reviewers:
 | `adr/ADR-0010-marca-y-nombre-de-artefacto.md` | ADR-0010         | accepted  |
 | `adr/ADR-0011-contrato-de-aplicacion.md`      | ADR-0011         | in-review |
 | `adr/ADR-0012-nombre-visible-forge.md`        | ADR-0012         | accepted  |
+| `adr/ADR-0019-perfil-vivo-archiso.md`         | ADR-0019         | accepted  |
 
 ## 03 — Datos
 
@@ -113,25 +114,26 @@ reviewers:
 
 ## 10 — Delivery
 
-| Documento                           | ID                   | Estado    |
-| ----------------------------------- | -------------------- | --------- |
-| `roadmap.md` (PD/MVP/v1/ENT)        | DOC-DEL-ROAD-001     | draft     |
-| `backlog.md`                        | DOC-DEL-BACK-001     | draft     |
-| `next-issues.md` (10 issues)        | DOC-DEL-ISS-001      | draft     |
-| `gates.md` (G0–G10)                 | DOC-DEL-GATE-001     | in-review |
-| `walking-skeleton.md` (slice MVP-0) | DOC-DEL-WSK-001      | in-review |
-| `packaging-release.md`              | DOC-DEL-PKG-001      | in-review |
-| `mvp5-scope.md`                     | DOC-DEL-MVP5-001     | accepted  |
-| `mvp5-gap-spec.md`                  | DOC-DEL-MVP5-GAP-001 | draft     |
-| `mvp6-scope.md`                     | DOC-DEL-MVP6-001     | accepted  |
-| `iso-scope.md`                      | DOC-DEL-ISO-001      | in-review |
-| `closure/f8-governance.md`          | DOC-DEL-CLO-F8-001   | accepted  |
-| `closure/p6-desktop-offline.md`     | DOC-DEL-CLO-P6-001   | draft     |
-| `closure/f9-release.md`             | DOC-DEL-CLO-F9-001   | in-review |
-| `closure/f7-candidate.md`           | DOC-DEL-CLO-F7-001   | draft     |
-| `closure/release-candidate.md`      | DOC-DEL-CLO-RC-001   | draft     |
-| `closure/closure-handoff.md`        | DOC-DEL-CLO-HAND-001 | draft     |
-| `remediation/acceptance-notes.md`   | DOC-DEL-REM-ACC-001  | in-review |
+| Documento                            | ID                    | Estado    |
+| ------------------------------------ | --------------------- | --------- |
+| `roadmap.md` (PD/MVP/v1/ENT)         | DOC-DEL-ROAD-001      | draft     |
+| `backlog.md`                         | DOC-DEL-BACK-001      | draft     |
+| `next-issues.md` (10 issues)         | DOC-DEL-ISS-001       | draft     |
+| `gates.md` (G0–G10)                  | DOC-DEL-GATE-001      | in-review |
+| `walking-skeleton.md` (slice MVP-0)  | DOC-DEL-WSK-001       | in-review |
+| `packaging-release.md`               | DOC-DEL-PKG-001       | in-review |
+| `mvp5-scope.md`                      | DOC-DEL-MVP5-001      | accepted  |
+| `mvp5-gap-spec.md`                   | DOC-DEL-MVP5-GAP-001  | draft     |
+| `mvp6-scope.md`                      | DOC-DEL-MVP6-001      | accepted  |
+| `iso-scope.md`                       | DOC-DEL-ISO-001       | accepted  |
+| `closure/f8-governance.md`           | DOC-DEL-CLO-F8-001    | accepted  |
+| `closure/p6-desktop-offline.md`      | DOC-DEL-CLO-P6-001    | draft     |
+| `closure/f9-release.md`              | DOC-DEL-CLO-F9-001    | in-review |
+| `closure/f7-candidate.md`            | DOC-DEL-CLO-F7-001    | draft     |
+| `closure/release-candidate.md`       | DOC-DEL-CLO-RC-001    | draft     |
+| `closure/closure-handoff.md`         | DOC-DEL-CLO-HAND-001  | draft     |
+| `closure/iso04-mkarchiso-not-run.md` | DOC-DEL-CLO-ISO04-001 | draft     |
+| `remediation/acceptance-notes.md`    | DOC-DEL-REM-ACC-001   | in-review |
 
 ## 11–12 — Operaciones e investigación
 
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 082e983..f3f58e5 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -15,6 +15,7 @@ serde_json = "1"
 sha2 = "0.10"
 rfd = { version = "=0.15.4", default-features = false, features = ["xdg-portal", "tokio"] }
 archmaker-core = { path = "../crates/archmaker-core" }
+archmaker-constitute = { path = "../crates/archmaker-constitute" }
 archmaker-hardware = { path = "../crates/archmaker-hardware" }
 archmaker-domain = { path = "../crates/archmaker-domain" }
 
diff --git a/src-tauri/build.rs b/src-tauri/build.rs
index 1f0f06d..9bbc075 100644
--- a/src-tauri/build.rs
+++ b/src-tauri/build.rs
@@ -17,6 +17,7 @@ fn main() {
             "propose_storage_plan",
             "validate_storage_plan",
             "import_storage_snapshot",
+            "constitute_image",
         ]),
     ))
     .expect("tauri_build with AppManifest::commands");
diff --git a/src-tauri/capabilities/main.json b/src-tauri/capabilities/main.json
index a824382..1af6a57 100644
--- a/src-tauri/capabilities/main.json
+++ b/src-tauri/capabilities/main.json
@@ -2,9 +2,7 @@
   "$schema": "../gen/schemas/desktop-schema.json",
   "identifier": "main-capability",
   "description": "Ventana main: CorePort + guardado nativo acotado (save_export_bytes). Sin shell ni FS global.",
-  "windows": [
-    "main"
-  ],
+  "windows": ["main"],
   "permissions": [
     "allow-create-draft",
     "allow-load-catalog",
@@ -21,6 +19,7 @@
     "allow-refresh-storage-snapshot",
     "allow-propose-storage-plan",
     "allow-validate-storage-plan",
-    "allow-import-storage-snapshot"
+    "allow-import-storage-snapshot",
+    "allow-constitute-image"
   ]
 }
diff --git a/src-tauri/gen/schemas/acl-manifests.json b/src-tauri/gen/schemas/acl-manifests.json
index 3d98d8e..6e958ab 100644
--- a/src-tauri/gen/schemas/acl-manifests.json
+++ b/src-tauri/gen/schemas/acl-manifests.json
@@ -1,3849 +1 @@
-{
-  "__app-acl__": {
-    "default_permission": null,
-    "permissions": {
-      "allow-build-manifest": {
-        "identifier": "allow-build-manifest",
-        "description": "Enables the build_manifest command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "build_manifest"
-          ],
-          "deny": []
-        }
-      },
-      "allow-create-draft": {
-        "identifier": "allow-create-draft",
-        "description": "Enables the create_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "create_draft"
-          ],
-          "deny": []
-        }
-      },
-      "allow-export-artifact": {
-        "identifier": "allow-export-artifact",
-        "description": "Enables the export_artifact command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "export_artifact"
-          ],
-          "deny": []
-        }
-      },
-      "allow-import-draft": {
-        "identifier": "allow-import-draft",
-        "description": "Enables the import_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "import_draft"
-          ],
-          "deny": []
-        }
-      },
-      "allow-import-storage-snapshot": {
-        "identifier": "allow-import-storage-snapshot",
-        "description": "Enables the import_storage_snapshot command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "import_storage_snapshot"
-          ],
-          "deny": []
-        }
-      },
-      "allow-inspect-host-hardware": {
-        "identifier": "allow-inspect-host-hardware",
-        "description": "Enables the inspect_host_hardware command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "inspect_host_hardware"
-          ],
-          "deny": []
-        }
-      },
-      "allow-inspect-storage-devices": {
-        "identifier": "allow-inspect-storage-devices",
-        "description": "Enables the inspect_storage_devices command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "inspect_storage_devices"
-          ],
-          "deny": []
-        }
-      },
-      "allow-load-catalog": {
-        "identifier": "allow-load-catalog",
-        "description": "Enables the load_catalog command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "load_catalog"
-          ],
-          "deny": []
-        }
-      },
-      "allow-open-draft": {
-        "identifier": "allow-open-draft",
-        "description": "Enables the open_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "open_draft"
-          ],
-          "deny": []
-        }
-      },
-      "allow-propose-storage-plan": {
-        "identifier": "allow-propose-storage-plan",
-        "description": "Enables the propose_storage_plan command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "propose_storage_plan"
-          ],
-          "deny": []
-        }
-      },
-      "allow-refresh-storage-snapshot": {
-        "identifier": "allow-refresh-storage-snapshot",
-        "description": "Enables the refresh_storage_snapshot command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "refresh_storage_snapshot"
-          ],
-          "deny": []
-        }
-      },
-      "allow-resolve-draft": {
-        "identifier": "allow-resolve-draft",
-        "description": "Enables the resolve_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "resolve_draft"
-          ],
-          "deny": []
-        }
-      },
-      "allow-save-draft": {
-        "identifier": "allow-save-draft",
-        "description": "Enables the save_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "save_draft"
-          ],
-          "deny": []
-        }
-      },
-      "allow-save-export-bytes": {
-        "identifier": "allow-save-export-bytes",
-        "description": "Enables the save_export_bytes command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "save_export_bytes"
-          ],
-          "deny": []
-        }
-      },
-      "allow-validate-draft": {
-        "identifier": "allow-validate-draft",
-        "description": "Enables the validate_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "validate_draft"
-          ],
-          "deny": []
-        }
-      },
-      "allow-validate-storage-plan": {
-        "identifier": "allow-validate-storage-plan",
-        "description": "Enables the validate_storage_plan command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "validate_storage_plan"
-          ],
-          "deny": []
-        }
-      },
-      "deny-build-manifest": {
-        "identifier": "deny-build-manifest",
-        "description": "Denies the build_manifest command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "build_manifest"
-          ]
-        }
-      },
-      "deny-create-draft": {
-        "identifier": "deny-create-draft",
-        "description": "Denies the create_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "create_draft"
-          ]
-        }
-      },
-      "deny-export-artifact": {
-        "identifier": "deny-export-artifact",
-        "description": "Denies the export_artifact command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "export_artifact"
-          ]
-        }
-      },
-      "deny-import-draft": {
-        "identifier": "deny-import-draft",
-        "description": "Denies the import_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "import_draft"
-          ]
-        }
-      },
-      "deny-import-storage-snapshot": {
-        "identifier": "deny-import-storage-snapshot",
-        "description": "Denies the import_storage_snapshot command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "import_storage_snapshot"
-          ]
-        }
-      },
-      "deny-inspect-host-hardware": {
-        "identifier": "deny-inspect-host-hardware",
-        "description": "Denies the inspect_host_hardware command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "inspect_host_hardware"
-          ]
-        }
-      },
-      "deny-inspect-storage-devices": {
-        "identifier": "deny-inspect-storage-devices",
-        "description": "Denies the inspect_storage_devices command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "inspect_storage_devices"
-          ]
-        }
-      },
-      "deny-load-catalog": {
-        "identifier": "deny-load-catalog",
-        "description": "Denies the load_catalog command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "load_catalog"
-          ]
-        }
-      },
-      "deny-open-draft": {
-        "identifier": "deny-open-draft",
-        "description": "Denies the open_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "open_draft"
-          ]
-        }
-      },
-      "deny-propose-storage-plan": {
-        "identifier": "deny-propose-storage-plan",
-        "description": "Denies the propose_storage_plan command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "propose_storage_plan"
-          ]
-        }
-      },
-      "deny-refresh-storage-snapshot": {
-        "identifier": "deny-refresh-storage-snapshot",
-        "description": "Denies the refresh_storage_snapshot command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "refresh_storage_snapshot"
-          ]
-        }
-      },
-      "deny-resolve-draft": {
-        "identifier": "deny-resolve-draft",
-        "description": "Denies the resolve_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "resolve_draft"
-          ]
-        }
-      },
-      "deny-save-draft": {
-        "identifier": "deny-save-draft",
-        "description": "Denies the save_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "save_draft"
-          ]
-        }
-      },
-      "deny-save-export-bytes": {
-        "identifier": "deny-save-export-bytes",
-        "description": "Denies the save_export_bytes command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "save_export_bytes"
-          ]
-        }
-      },
-      "deny-validate-draft": {
-        "identifier": "deny-validate-draft",
-        "description": "Denies the validate_draft command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "validate_draft"
-          ]
-        }
-      },
-      "deny-validate-storage-plan": {
-        "identifier": "deny-validate-storage-plan",
-        "description": "Denies the validate_storage_plan command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "validate_storage_plan"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default core plugins set.",
-      "permissions": [
-        "core:path:default",
-        "core:event:default",
-        "core:window:default",
-        "core:webview:default",
-        "core:app:default",
-        "core:image:default",
-        "core:resources:default",
-        "core:menu:default",
-        "core:tray:default"
-      ]
-    },
-    "permissions": {},
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:app": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin.",
-      "permissions": [
-        "allow-version",
-        "allow-name",
-        "allow-tauri-version",
-        "allow-identifier",
-        "allow-bundle-type",
-        "allow-register-listener",
-        "allow-remove-listener",
-        "allow-supports-multiple-windows"
-      ]
-    },
-    "permissions": {
-      "allow-app-hide": {
-        "identifier": "allow-app-hide",
-        "description": "Enables the app_hide command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "app_hide"
-          ],
-          "deny": []
-        }
-      },
-      "allow-app-show": {
-        "identifier": "allow-app-show",
-        "description": "Enables the app_show command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "app_show"
-          ],
-          "deny": []
-        }
-      },
-      "allow-bundle-type": {
-        "identifier": "allow-bundle-type",
-        "description": "Enables the bundle_type command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "bundle_type"
-          ],
-          "deny": []
-        }
-      },
-      "allow-default-window-icon": {
-        "identifier": "allow-default-window-icon",
-        "description": "Enables the default_window_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "default_window_icon"
-          ],
-          "deny": []
-        }
-      },
-      "allow-exit": {
-        "identifier": "allow-exit",
-        "description": "Enables the exit command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "exit"
-          ],
-          "deny": []
-        }
-      },
-      "allow-fetch-data-store-identifiers": {
-        "identifier": "allow-fetch-data-store-identifiers",
-        "description": "Enables the fetch_data_store_identifiers command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "fetch_data_store_identifiers"
-          ],
-          "deny": []
-        }
-      },
-      "allow-identifier": {
-        "identifier": "allow-identifier",
-        "description": "Enables the identifier command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "identifier"
-          ],
-          "deny": []
-        }
-      },
-      "allow-name": {
-        "identifier": "allow-name",
-        "description": "Enables the name command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "name"
-          ],
-          "deny": []
-        }
-      },
-      "allow-register-listener": {
-        "identifier": "allow-register-listener",
-        "description": "Enables the register_listener command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "register_listener"
-          ],
-          "deny": []
-        }
-      },
-      "allow-remove-data-store": {
-        "identifier": "allow-remove-data-store",
-        "description": "Enables the remove_data_store command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "remove_data_store"
-          ],
-          "deny": []
-        }
-      },
-      "allow-remove-listener": {
-        "identifier": "allow-remove-listener",
-        "description": "Enables the remove_listener command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "remove_listener"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-app-theme": {
-        "identifier": "allow-set-app-theme",
-        "description": "Enables the set_app_theme command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_app_theme"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-dock-visibility": {
-        "identifier": "allow-set-dock-visibility",
-        "description": "Enables the set_dock_visibility command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_dock_visibility"
-          ],
-          "deny": []
-        }
-      },
-      "allow-supports-multiple-windows": {
-        "identifier": "allow-supports-multiple-windows",
-        "description": "Enables the supports_multiple_windows command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "supports_multiple_windows"
-          ],
-          "deny": []
-        }
-      },
-      "allow-tauri-version": {
-        "identifier": "allow-tauri-version",
-        "description": "Enables the tauri_version command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "tauri_version"
-          ],
-          "deny": []
-        }
-      },
-      "allow-version": {
-        "identifier": "allow-version",
-        "description": "Enables the version command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "version"
-          ],
-          "deny": []
-        }
-      },
-      "deny-app-hide": {
-        "identifier": "deny-app-hide",
-        "description": "Denies the app_hide command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "app_hide"
-          ]
-        }
-      },
-      "deny-app-show": {
-        "identifier": "deny-app-show",
-        "description": "Denies the app_show command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "app_show"
-          ]
-        }
-      },
-      "deny-bundle-type": {
-        "identifier": "deny-bundle-type",
-        "description": "Denies the bundle_type command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "bundle_type"
-          ]
-        }
-      },
-      "deny-default-window-icon": {
-        "identifier": "deny-default-window-icon",
-        "description": "Denies the default_window_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "default_window_icon"
-          ]
-        }
-      },
-      "deny-exit": {
-        "identifier": "deny-exit",
-        "description": "Denies the exit command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "exit"
-          ]
-        }
-      },
-      "deny-fetch-data-store-identifiers": {
-        "identifier": "deny-fetch-data-store-identifiers",
-        "description": "Denies the fetch_data_store_identifiers command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "fetch_data_store_identifiers"
-          ]
-        }
-      },
-      "deny-identifier": {
-        "identifier": "deny-identifier",
-        "description": "Denies the identifier command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "identifier"
-          ]
-        }
-      },
-      "deny-name": {
-        "identifier": "deny-name",
-        "description": "Denies the name command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "name"
-          ]
-        }
-      },
-      "deny-register-listener": {
-        "identifier": "deny-register-listener",
-        "description": "Denies the register_listener command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "register_listener"
-          ]
-        }
-      },
-      "deny-remove-data-store": {
-        "identifier": "deny-remove-data-store",
-        "description": "Denies the remove_data_store command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "remove_data_store"
-          ]
-        }
-      },
-      "deny-remove-listener": {
-        "identifier": "deny-remove-listener",
-        "description": "Denies the remove_listener command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "remove_listener"
-          ]
-        }
-      },
-      "deny-set-app-theme": {
-        "identifier": "deny-set-app-theme",
-        "description": "Denies the set_app_theme command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_app_theme"
-          ]
-        }
-      },
-      "deny-set-dock-visibility": {
-        "identifier": "deny-set-dock-visibility",
-        "description": "Denies the set_dock_visibility command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_dock_visibility"
-          ]
-        }
-      },
-      "deny-supports-multiple-windows": {
-        "identifier": "deny-supports-multiple-windows",
-        "description": "Denies the supports_multiple_windows command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "supports_multiple_windows"
-          ]
-        }
-      },
-      "deny-tauri-version": {
-        "identifier": "deny-tauri-version",
-        "description": "Denies the tauri_version command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "tauri_version"
-          ]
-        }
-      },
-      "deny-version": {
-        "identifier": "deny-version",
-        "description": "Denies the version command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "version"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:event": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin, which enables all commands.",
-      "permissions": [
-        "allow-listen",
-        "allow-unlisten",
-        "allow-emit",
-        "allow-emit-to"
-      ]
-    },
-    "permissions": {
-      "allow-emit": {
-        "identifier": "allow-emit",
-        "description": "Enables the emit command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "emit"
-          ],
-          "deny": []
-        }
-      },
-      "allow-emit-to": {
-        "identifier": "allow-emit-to",
-        "description": "Enables the emit_to command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "emit_to"
-          ],
-          "deny": []
-        }
-      },
-      "allow-listen": {
-        "identifier": "allow-listen",
-        "description": "Enables the listen command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "listen"
-          ],
-          "deny": []
-        }
-      },
-      "allow-unlisten": {
-        "identifier": "allow-unlisten",
-        "description": "Enables the unlisten command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "unlisten"
-          ],
-          "deny": []
-        }
-      },
-      "deny-emit": {
-        "identifier": "deny-emit",
-        "description": "Denies the emit command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "emit"
-          ]
-        }
-      },
-      "deny-emit-to": {
-        "identifier": "deny-emit-to",
-        "description": "Denies the emit_to command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "emit_to"
-          ]
-        }
-      },
-      "deny-listen": {
-        "identifier": "deny-listen",
-        "description": "Denies the listen command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "listen"
-          ]
-        }
-      },
-      "deny-unlisten": {
-        "identifier": "deny-unlisten",
-        "description": "Denies the unlisten command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "unlisten"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:image": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin, which enables all commands.",
-      "permissions": [
-        "allow-new",
-        "allow-from-bytes",
-        "allow-from-path",
-        "allow-rgba",
-        "allow-size"
-      ]
-    },
-    "permissions": {
-      "allow-from-bytes": {
-        "identifier": "allow-from-bytes",
-        "description": "Enables the from_bytes command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "from_bytes"
-          ],
-          "deny": []
-        }
-      },
-      "allow-from-path": {
-        "identifier": "allow-from-path",
-        "description": "Enables the from_path command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "from_path"
-          ],
-          "deny": []
-        }
-      },
-      "allow-new": {
-        "identifier": "allow-new",
-        "description": "Enables the new command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "new"
-          ],
-          "deny": []
-        }
-      },
-      "allow-rgba": {
-        "identifier": "allow-rgba",
-        "description": "Enables the rgba command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "rgba"
-          ],
-          "deny": []
-        }
-      },
-      "allow-size": {
-        "identifier": "allow-size",
-        "description": "Enables the size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "size"
-          ],
-          "deny": []
-        }
-      },
-      "deny-from-bytes": {
-        "identifier": "deny-from-bytes",
-        "description": "Denies the from_bytes command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "from_bytes"
-          ]
-        }
-      },
-      "deny-from-path": {
-        "identifier": "deny-from-path",
-        "description": "Denies the from_path command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "from_path"
-          ]
-        }
-      },
-      "deny-new": {
-        "identifier": "deny-new",
-        "description": "Denies the new command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "new"
-          ]
-        }
-      },
-      "deny-rgba": {
-        "identifier": "deny-rgba",
-        "description": "Denies the rgba command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "rgba"
-          ]
-        }
-      },
-      "deny-size": {
-        "identifier": "deny-size",
-        "description": "Denies the size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "size"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:menu": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin, which enables all commands.",
-      "permissions": [
-        "allow-new",
-        "allow-append",
-        "allow-prepend",
-        "allow-insert",
-        "allow-remove",
-        "allow-remove-at",
-        "allow-items",
-        "allow-get",
-        "allow-popup",
-        "allow-create-default",
-        "allow-set-as-app-menu",
-        "allow-set-as-window-menu",
-        "allow-text",
-        "allow-set-text",
-        "allow-is-enabled",
-        "allow-set-enabled",
-        "allow-set-accelerator",
-        "allow-set-as-windows-menu-for-nsapp",
-        "allow-set-as-help-menu-for-nsapp",
-        "allow-is-checked",
-        "allow-set-checked",
-        "allow-set-icon"
-      ]
-    },
-    "permissions": {
-      "allow-append": {
-        "identifier": "allow-append",
-        "description": "Enables the append command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "append"
-          ],
-          "deny": []
-        }
-      },
-      "allow-create-default": {
-        "identifier": "allow-create-default",
-        "description": "Enables the create_default command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "create_default"
-          ],
-          "deny": []
-        }
-      },
-      "allow-get": {
-        "identifier": "allow-get",
-        "description": "Enables the get command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "get"
-          ],
-          "deny": []
-        }
-      },
-      "allow-insert": {
-        "identifier": "allow-insert",
-        "description": "Enables the insert command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "insert"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-checked": {
-        "identifier": "allow-is-checked",
-        "description": "Enables the is_checked command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_checked"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-enabled": {
-        "identifier": "allow-is-enabled",
-        "description": "Enables the is_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_enabled"
-          ],
-          "deny": []
-        }
-      },
-      "allow-items": {
-        "identifier": "allow-items",
-        "description": "Enables the items command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "items"
-          ],
-          "deny": []
-        }
-      },
-      "allow-new": {
-        "identifier": "allow-new",
-        "description": "Enables the new command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "new"
-          ],
-          "deny": []
-        }
-      },
-      "allow-popup": {
-        "identifier": "allow-popup",
-        "description": "Enables the popup command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "popup"
-          ],
-          "deny": []
-        }
-      },
-      "allow-prepend": {
-        "identifier": "allow-prepend",
-        "description": "Enables the prepend command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "prepend"
-          ],
-          "deny": []
-        }
-      },
-      "allow-remove": {
-        "identifier": "allow-remove",
-        "description": "Enables the remove command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "remove"
-          ],
-          "deny": []
-        }
-      },
-      "allow-remove-at": {
-        "identifier": "allow-remove-at",
-        "description": "Enables the remove_at command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "remove_at"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-accelerator": {
-        "identifier": "allow-set-accelerator",
-        "description": "Enables the set_accelerator command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_accelerator"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-as-app-menu": {
-        "identifier": "allow-set-as-app-menu",
-        "description": "Enables the set_as_app_menu command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_as_app_menu"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-as-help-menu-for-nsapp": {
-        "identifier": "allow-set-as-help-menu-for-nsapp",
-        "description": "Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_as_help_menu_for_nsapp"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-as-window-menu": {
-        "identifier": "allow-set-as-window-menu",
-        "description": "Enables the set_as_window_menu command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_as_window_menu"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-as-windows-menu-for-nsapp": {
-        "identifier": "allow-set-as-windows-menu-for-nsapp",
-        "description": "Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_as_windows_menu_for_nsapp"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-checked": {
-        "identifier": "allow-set-checked",
-        "description": "Enables the set_checked command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_checked"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-enabled": {
-        "identifier": "allow-set-enabled",
-        "description": "Enables the set_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_enabled"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-icon": {
-        "identifier": "allow-set-icon",
-        "description": "Enables the set_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_icon"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-text": {
-        "identifier": "allow-set-text",
-        "description": "Enables the set_text command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_text"
-          ],
-          "deny": []
-        }
-      },
-      "allow-text": {
-        "identifier": "allow-text",
-        "description": "Enables the text command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "text"
-          ],
-          "deny": []
-        }
-      },
-      "deny-append": {
-        "identifier": "deny-append",
-        "description": "Denies the append command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "append"
-          ]
-        }
-      },
-      "deny-create-default": {
-        "identifier": "deny-create-default",
-        "description": "Denies the create_default command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "create_default"
-          ]
-        }
-      },
-      "deny-get": {
-        "identifier": "deny-get",
-        "description": "Denies the get command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "get"
-          ]
-        }
-      },
-      "deny-insert": {
-        "identifier": "deny-insert",
-        "description": "Denies the insert command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "insert"
-          ]
-        }
-      },
-      "deny-is-checked": {
-        "identifier": "deny-is-checked",
-        "description": "Denies the is_checked command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_checked"
-          ]
-        }
-      },
-      "deny-is-enabled": {
-        "identifier": "deny-is-enabled",
-        "description": "Denies the is_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_enabled"
-          ]
-        }
-      },
-      "deny-items": {
-        "identifier": "deny-items",
-        "description": "Denies the items command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "items"
-          ]
-        }
-      },
-      "deny-new": {
-        "identifier": "deny-new",
-        "description": "Denies the new command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "new"
-          ]
-        }
-      },
-      "deny-popup": {
-        "identifier": "deny-popup",
-        "description": "Denies the popup command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "popup"
-          ]
-        }
-      },
-      "deny-prepend": {
-        "identifier": "deny-prepend",
-        "description": "Denies the prepend command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "prepend"
-          ]
-        }
-      },
-      "deny-remove": {
-        "identifier": "deny-remove",
-        "description": "Denies the remove command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "remove"
-          ]
-        }
-      },
-      "deny-remove-at": {
-        "identifier": "deny-remove-at",
-        "description": "Denies the remove_at command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "remove_at"
-          ]
-        }
-      },
-      "deny-set-accelerator": {
-        "identifier": "deny-set-accelerator",
-        "description": "Denies the set_accelerator command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_accelerator"
-          ]
-        }
-      },
-      "deny-set-as-app-menu": {
-        "identifier": "deny-set-as-app-menu",
-        "description": "Denies the set_as_app_menu command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_as_app_menu"
-          ]
-        }
-      },
-      "deny-set-as-help-menu-for-nsapp": {
-        "identifier": "deny-set-as-help-menu-for-nsapp",
-        "description": "Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_as_help_menu_for_nsapp"
-          ]
-        }
-      },
-      "deny-set-as-window-menu": {
-        "identifier": "deny-set-as-window-menu",
-        "description": "Denies the set_as_window_menu command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_as_window_menu"
-          ]
-        }
-      },
-      "deny-set-as-windows-menu-for-nsapp": {
-        "identifier": "deny-set-as-windows-menu-for-nsapp",
-        "description": "Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_as_windows_menu_for_nsapp"
-          ]
-        }
-      },
-      "deny-set-checked": {
-        "identifier": "deny-set-checked",
-        "description": "Denies the set_checked command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_checked"
-          ]
-        }
-      },
-      "deny-set-enabled": {
-        "identifier": "deny-set-enabled",
-        "description": "Denies the set_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_enabled"
-          ]
-        }
-      },
-      "deny-set-icon": {
-        "identifier": "deny-set-icon",
-        "description": "Denies the set_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_icon"
-          ]
-        }
-      },
-      "deny-set-text": {
-        "identifier": "deny-set-text",
-        "description": "Denies the set_text command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_text"
-          ]
-        }
-      },
-      "deny-text": {
-        "identifier": "deny-text",
-        "description": "Denies the text command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "text"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:path": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin, which enables all commands.",
-      "permissions": [
-        "allow-resolve-directory",
-        "allow-resolve",
-        "allow-normalize",
-        "allow-join",
-        "allow-dirname",
-        "allow-extname",
-        "allow-basename",
-        "allow-is-absolute"
-      ]
-    },
-    "permissions": {
-      "allow-basename": {
-        "identifier": "allow-basename",
-        "description": "Enables the basename command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "basename"
-          ],
-          "deny": []
-        }
-      },
-      "allow-dirname": {
-        "identifier": "allow-dirname",
-        "description": "Enables the dirname command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "dirname"
-          ],
-          "deny": []
-        }
-      },
-      "allow-extname": {
-        "identifier": "allow-extname",
-        "description": "Enables the extname command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "extname"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-absolute": {
-        "identifier": "allow-is-absolute",
-        "description": "Enables the is_absolute command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_absolute"
-          ],
-          "deny": []
-        }
-      },
-      "allow-join": {
-        "identifier": "allow-join",
-        "description": "Enables the join command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "join"
-          ],
-          "deny": []
-        }
-      },
-      "allow-normalize": {
-        "identifier": "allow-normalize",
-        "description": "Enables the normalize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "normalize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-resolve": {
-        "identifier": "allow-resolve",
-        "description": "Enables the resolve command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "resolve"
-          ],
-          "deny": []
-        }
-      },
-      "allow-resolve-directory": {
-        "identifier": "allow-resolve-directory",
-        "description": "Enables the resolve_directory command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "resolve_directory"
-          ],
-          "deny": []
-        }
-      },
-      "deny-basename": {
-        "identifier": "deny-basename",
-        "description": "Denies the basename command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "basename"
-          ]
-        }
-      },
-      "deny-dirname": {
-        "identifier": "deny-dirname",
-        "description": "Denies the dirname command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "dirname"
-          ]
-        }
-      },
-      "deny-extname": {
-        "identifier": "deny-extname",
-        "description": "Denies the extname command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "extname"
-          ]
-        }
-      },
-      "deny-is-absolute": {
-        "identifier": "deny-is-absolute",
-        "description": "Denies the is_absolute command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_absolute"
-          ]
-        }
-      },
-      "deny-join": {
-        "identifier": "deny-join",
-        "description": "Denies the join command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "join"
-          ]
-        }
-      },
-      "deny-normalize": {
-        "identifier": "deny-normalize",
-        "description": "Denies the normalize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "normalize"
-          ]
-        }
-      },
-      "deny-resolve": {
-        "identifier": "deny-resolve",
-        "description": "Denies the resolve command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "resolve"
-          ]
-        }
-      },
-      "deny-resolve-directory": {
-        "identifier": "deny-resolve-directory",
-        "description": "Denies the resolve_directory command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "resolve_directory"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:resources": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin, which enables all commands.",
-      "permissions": [
-        "allow-close"
-      ]
-    },
-    "permissions": {
-      "allow-close": {
-        "identifier": "allow-close",
-        "description": "Enables the close command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "close"
-          ],
-          "deny": []
-        }
-      },
-      "deny-close": {
-        "identifier": "deny-close",
-        "description": "Denies the close command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "close"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:tray": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin, which enables all commands.",
-      "permissions": [
-        "allow-new",
-        "allow-get-by-id",
-        "allow-remove-by-id",
-        "allow-set-icon",
-        "allow-set-menu",
-        "allow-set-tooltip",
-        "allow-set-title",
-        "allow-set-visible",
-        "allow-set-temp-dir-path",
-        "allow-set-icon-as-template",
-        "allow-set-icon-with-as-template",
-        "allow-set-show-menu-on-left-click"
-      ]
-    },
-    "permissions": {
-      "allow-get-by-id": {
-        "identifier": "allow-get-by-id",
-        "description": "Enables the get_by_id command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "get_by_id"
-          ],
-          "deny": []
-        }
-      },
-      "allow-new": {
-        "identifier": "allow-new",
-        "description": "Enables the new command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "new"
-          ],
-          "deny": []
-        }
-      },
-      "allow-remove-by-id": {
-        "identifier": "allow-remove-by-id",
-        "description": "Enables the remove_by_id command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "remove_by_id"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-icon": {
-        "identifier": "allow-set-icon",
-        "description": "Enables the set_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_icon"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-icon-as-template": {
-        "identifier": "allow-set-icon-as-template",
-        "description": "Enables the set_icon_as_template command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_icon_as_template"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-icon-with-as-template": {
-        "identifier": "allow-set-icon-with-as-template",
-        "description": "Enables the set_icon_with_as_template command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_icon_with_as_template"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-menu": {
-        "identifier": "allow-set-menu",
-        "description": "Enables the set_menu command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_menu"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-show-menu-on-left-click": {
-        "identifier": "allow-set-show-menu-on-left-click",
-        "description": "Enables the set_show_menu_on_left_click command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_show_menu_on_left_click"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-temp-dir-path": {
-        "identifier": "allow-set-temp-dir-path",
-        "description": "Enables the set_temp_dir_path command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_temp_dir_path"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-title": {
-        "identifier": "allow-set-title",
-        "description": "Enables the set_title command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_title"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-tooltip": {
-        "identifier": "allow-set-tooltip",
-        "description": "Enables the set_tooltip command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_tooltip"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-visible": {
-        "identifier": "allow-set-visible",
-        "description": "Enables the set_visible command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_visible"
-          ],
-          "deny": []
-        }
-      },
-      "deny-get-by-id": {
-        "identifier": "deny-get-by-id",
-        "description": "Denies the get_by_id command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "get_by_id"
-          ]
-        }
-      },
-      "deny-new": {
-        "identifier": "deny-new",
-        "description": "Denies the new command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "new"
-          ]
-        }
-      },
-      "deny-remove-by-id": {
-        "identifier": "deny-remove-by-id",
-        "description": "Denies the remove_by_id command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "remove_by_id"
-          ]
-        }
-      },
-      "deny-set-icon": {
-        "identifier": "deny-set-icon",
-        "description": "Denies the set_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_icon"
-          ]
-        }
-      },
-      "deny-set-icon-as-template": {
-        "identifier": "deny-set-icon-as-template",
-        "description": "Denies the set_icon_as_template command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_icon_as_template"
-          ]
-        }
-      },
-      "deny-set-icon-with-as-template": {
-        "identifier": "deny-set-icon-with-as-template",
-        "description": "Denies the set_icon_with_as_template command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_icon_with_as_template"
-          ]
-        }
-      },
-      "deny-set-menu": {
-        "identifier": "deny-set-menu",
-        "description": "Denies the set_menu command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_menu"
-          ]
-        }
-      },
-      "deny-set-show-menu-on-left-click": {
-        "identifier": "deny-set-show-menu-on-left-click",
-        "description": "Denies the set_show_menu_on_left_click command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_show_menu_on_left_click"
-          ]
-        }
-      },
-      "deny-set-temp-dir-path": {
-        "identifier": "deny-set-temp-dir-path",
-        "description": "Denies the set_temp_dir_path command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_temp_dir_path"
-          ]
-        }
-      },
-      "deny-set-title": {
-        "identifier": "deny-set-title",
-        "description": "Denies the set_title command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_title"
-          ]
-        }
-      },
-      "deny-set-tooltip": {
-        "identifier": "deny-set-tooltip",
-        "description": "Denies the set_tooltip command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_tooltip"
-          ]
-        }
-      },
-      "deny-set-visible": {
-        "identifier": "deny-set-visible",
-        "description": "Denies the set_visible command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_visible"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:webview": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin.",
-      "permissions": [
-        "allow-get-all-webviews",
-        "allow-webview-position",
-        "allow-webview-size",
-        "allow-internal-toggle-devtools"
-      ]
-    },
-    "permissions": {
-      "allow-clear-all-browsing-data": {
-        "identifier": "allow-clear-all-browsing-data",
-        "description": "Enables the clear_all_browsing_data command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "clear_all_browsing_data"
-          ],
-          "deny": []
-        }
-      },
-      "allow-create-webview": {
-        "identifier": "allow-create-webview",
-        "description": "Enables the create_webview command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "create_webview"
-          ],
-          "deny": []
-        }
-      },
-      "allow-create-webview-window": {
-        "identifier": "allow-create-webview-window",
-        "description": "Enables the create_webview_window command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "create_webview_window"
-          ],
-          "deny": []
-        }
-      },
-      "allow-get-all-webviews": {
-        "identifier": "allow-get-all-webviews",
-        "description": "Enables the get_all_webviews command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "get_all_webviews"
-          ],
-          "deny": []
-        }
-      },
-      "allow-internal-toggle-devtools": {
-        "identifier": "allow-internal-toggle-devtools",
-        "description": "Enables the internal_toggle_devtools command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "internal_toggle_devtools"
-          ],
-          "deny": []
-        }
-      },
-      "allow-print": {
-        "identifier": "allow-print",
-        "description": "Enables the print command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "print"
-          ],
-          "deny": []
-        }
-      },
-      "allow-reparent": {
-        "identifier": "allow-reparent",
-        "description": "Enables the reparent command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "reparent"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-webview-auto-resize": {
-        "identifier": "allow-set-webview-auto-resize",
-        "description": "Enables the set_webview_auto_resize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_webview_auto_resize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-webview-background-color": {
-        "identifier": "allow-set-webview-background-color",
-        "description": "Enables the set_webview_background_color command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_webview_background_color"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-webview-focus": {
-        "identifier": "allow-set-webview-focus",
-        "description": "Enables the set_webview_focus command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_webview_focus"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-webview-position": {
-        "identifier": "allow-set-webview-position",
-        "description": "Enables the set_webview_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_webview_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-webview-size": {
-        "identifier": "allow-set-webview-size",
-        "description": "Enables the set_webview_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_webview_size"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-webview-zoom": {
-        "identifier": "allow-set-webview-zoom",
-        "description": "Enables the set_webview_zoom command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_webview_zoom"
-          ],
-          "deny": []
-        }
-      },
-      "allow-webview-close": {
-        "identifier": "allow-webview-close",
-        "description": "Enables the webview_close command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "webview_close"
-          ],
-          "deny": []
-        }
-      },
-      "allow-webview-hide": {
-        "identifier": "allow-webview-hide",
-        "description": "Enables the webview_hide command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "webview_hide"
-          ],
-          "deny": []
-        }
-      },
-      "allow-webview-position": {
-        "identifier": "allow-webview-position",
-        "description": "Enables the webview_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "webview_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-webview-show": {
-        "identifier": "allow-webview-show",
-        "description": "Enables the webview_show command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "webview_show"
-          ],
-          "deny": []
-        }
-      },
-      "allow-webview-size": {
-        "identifier": "allow-webview-size",
-        "description": "Enables the webview_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "webview_size"
-          ],
-          "deny": []
-        }
-      },
-      "deny-clear-all-browsing-data": {
-        "identifier": "deny-clear-all-browsing-data",
-        "description": "Denies the clear_all_browsing_data command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "clear_all_browsing_data"
-          ]
-        }
-      },
-      "deny-create-webview": {
-        "identifier": "deny-create-webview",
-        "description": "Denies the create_webview command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "create_webview"
-          ]
-        }
-      },
-      "deny-create-webview-window": {
-        "identifier": "deny-create-webview-window",
-        "description": "Denies the create_webview_window command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "create_webview_window"
-          ]
-        }
-      },
-      "deny-get-all-webviews": {
-        "identifier": "deny-get-all-webviews",
-        "description": "Denies the get_all_webviews command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "get_all_webviews"
-          ]
-        }
-      },
-      "deny-internal-toggle-devtools": {
-        "identifier": "deny-internal-toggle-devtools",
-        "description": "Denies the internal_toggle_devtools command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "internal_toggle_devtools"
-          ]
-        }
-      },
-      "deny-print": {
-        "identifier": "deny-print",
-        "description": "Denies the print command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "print"
-          ]
-        }
-      },
-      "deny-reparent": {
-        "identifier": "deny-reparent",
-        "description": "Denies the reparent command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "reparent"
-          ]
-        }
-      },
-      "deny-set-webview-auto-resize": {
-        "identifier": "deny-set-webview-auto-resize",
-        "description": "Denies the set_webview_auto_resize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_webview_auto_resize"
-          ]
-        }
-      },
-      "deny-set-webview-background-color": {
-        "identifier": "deny-set-webview-background-color",
-        "description": "Denies the set_webview_background_color command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_webview_background_color"
-          ]
-        }
-      },
-      "deny-set-webview-focus": {
-        "identifier": "deny-set-webview-focus",
-        "description": "Denies the set_webview_focus command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_webview_focus"
-          ]
-        }
-      },
-      "deny-set-webview-position": {
-        "identifier": "deny-set-webview-position",
-        "description": "Denies the set_webview_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_webview_position"
-          ]
-        }
-      },
-      "deny-set-webview-size": {
-        "identifier": "deny-set-webview-size",
-        "description": "Denies the set_webview_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_webview_size"
-          ]
-        }
-      },
-      "deny-set-webview-zoom": {
-        "identifier": "deny-set-webview-zoom",
-        "description": "Denies the set_webview_zoom command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_webview_zoom"
-          ]
-        }
-      },
-      "deny-webview-close": {
-        "identifier": "deny-webview-close",
-        "description": "Denies the webview_close command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "webview_close"
-          ]
-        }
-      },
-      "deny-webview-hide": {
-        "identifier": "deny-webview-hide",
-        "description": "Denies the webview_hide command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "webview_hide"
-          ]
-        }
-      },
-      "deny-webview-position": {
-        "identifier": "deny-webview-position",
-        "description": "Denies the webview_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "webview_position"
-          ]
-        }
-      },
-      "deny-webview-show": {
-        "identifier": "deny-webview-show",
-        "description": "Denies the webview_show command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "webview_show"
-          ]
-        }
-      },
-      "deny-webview-size": {
-        "identifier": "deny-webview-size",
-        "description": "Denies the webview_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "webview_size"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  },
-  "core:window": {
-    "default_permission": {
-      "identifier": "default",
-      "description": "Default permissions for the plugin.",
-      "permissions": [
-        "allow-get-all-windows",
-        "allow-scale-factor",
-        "allow-inner-position",
-        "allow-outer-position",
-        "allow-inner-size",
-        "allow-outer-size",
-        "allow-is-fullscreen",
-        "allow-is-minimized",
-        "allow-is-maximized",
-        "allow-is-focused",
-        "allow-is-decorated",
-        "allow-is-resizable",
-        "allow-is-maximizable",
-        "allow-is-minimizable",
-        "allow-is-closable",
-        "allow-is-visible",
-        "allow-is-enabled",
-        "allow-title",
-        "allow-current-monitor",
-        "allow-primary-monitor",
-        "allow-monitor-from-point",
-        "allow-available-monitors",
-        "allow-cursor-position",
-        "allow-theme",
-        "allow-is-always-on-top",
-        "allow-activity-name",
-        "allow-scene-identifier",
-        "allow-internal-toggle-maximize"
-      ]
-    },
-    "permissions": {
-      "allow-activity-name": {
-        "identifier": "allow-activity-name",
-        "description": "Enables the activity_name command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "activity_name"
-          ],
-          "deny": []
-        }
-      },
-      "allow-available-monitors": {
-        "identifier": "allow-available-monitors",
-        "description": "Enables the available_monitors command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "available_monitors"
-          ],
-          "deny": []
-        }
-      },
-      "allow-center": {
-        "identifier": "allow-center",
-        "description": "Enables the center command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "center"
-          ],
-          "deny": []
-        }
-      },
-      "allow-close": {
-        "identifier": "allow-close",
-        "description": "Enables the close command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "close"
-          ],
-          "deny": []
-        }
-      },
-      "allow-create": {
-        "identifier": "allow-create",
-        "description": "Enables the create command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "create"
-          ],
-          "deny": []
-        }
-      },
-      "allow-current-monitor": {
-        "identifier": "allow-current-monitor",
-        "description": "Enables the current_monitor command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "current_monitor"
-          ],
-          "deny": []
-        }
-      },
-      "allow-cursor-position": {
-        "identifier": "allow-cursor-position",
-        "description": "Enables the cursor_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "cursor_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-destroy": {
-        "identifier": "allow-destroy",
-        "description": "Enables the destroy command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "destroy"
-          ],
-          "deny": []
-        }
-      },
-      "allow-get-all-windows": {
-        "identifier": "allow-get-all-windows",
-        "description": "Enables the get_all_windows command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "get_all_windows"
-          ],
-          "deny": []
-        }
-      },
-      "allow-hide": {
-        "identifier": "allow-hide",
-        "description": "Enables the hide command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "hide"
-          ],
-          "deny": []
-        }
-      },
-      "allow-inner-position": {
-        "identifier": "allow-inner-position",
-        "description": "Enables the inner_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "inner_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-inner-size": {
-        "identifier": "allow-inner-size",
-        "description": "Enables the inner_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "inner_size"
-          ],
-          "deny": []
-        }
-      },
-      "allow-internal-toggle-maximize": {
-        "identifier": "allow-internal-toggle-maximize",
-        "description": "Enables the internal_toggle_maximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "internal_toggle_maximize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-always-on-top": {
-        "identifier": "allow-is-always-on-top",
-        "description": "Enables the is_always_on_top command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_always_on_top"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-closable": {
-        "identifier": "allow-is-closable",
-        "description": "Enables the is_closable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_closable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-decorated": {
-        "identifier": "allow-is-decorated",
-        "description": "Enables the is_decorated command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_decorated"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-enabled": {
-        "identifier": "allow-is-enabled",
-        "description": "Enables the is_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_enabled"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-focused": {
-        "identifier": "allow-is-focused",
-        "description": "Enables the is_focused command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_focused"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-fullscreen": {
-        "identifier": "allow-is-fullscreen",
-        "description": "Enables the is_fullscreen command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_fullscreen"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-maximizable": {
-        "identifier": "allow-is-maximizable",
-        "description": "Enables the is_maximizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_maximizable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-maximized": {
-        "identifier": "allow-is-maximized",
-        "description": "Enables the is_maximized command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_maximized"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-minimizable": {
-        "identifier": "allow-is-minimizable",
-        "description": "Enables the is_minimizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_minimizable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-minimized": {
-        "identifier": "allow-is-minimized",
-        "description": "Enables the is_minimized command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_minimized"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-resizable": {
-        "identifier": "allow-is-resizable",
-        "description": "Enables the is_resizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_resizable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-is-visible": {
-        "identifier": "allow-is-visible",
-        "description": "Enables the is_visible command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "is_visible"
-          ],
-          "deny": []
-        }
-      },
-      "allow-maximize": {
-        "identifier": "allow-maximize",
-        "description": "Enables the maximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "maximize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-minimize": {
-        "identifier": "allow-minimize",
-        "description": "Enables the minimize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "minimize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-monitor-from-point": {
-        "identifier": "allow-monitor-from-point",
-        "description": "Enables the monitor_from_point command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "monitor_from_point"
-          ],
-          "deny": []
-        }
-      },
-      "allow-outer-position": {
-        "identifier": "allow-outer-position",
-        "description": "Enables the outer_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "outer_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-outer-size": {
-        "identifier": "allow-outer-size",
-        "description": "Enables the outer_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "outer_size"
-          ],
-          "deny": []
-        }
-      },
-      "allow-primary-monitor": {
-        "identifier": "allow-primary-monitor",
-        "description": "Enables the primary_monitor command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "primary_monitor"
-          ],
-          "deny": []
-        }
-      },
-      "allow-request-user-attention": {
-        "identifier": "allow-request-user-attention",
-        "description": "Enables the request_user_attention command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "request_user_attention"
-          ],
-          "deny": []
-        }
-      },
-      "allow-scale-factor": {
-        "identifier": "allow-scale-factor",
-        "description": "Enables the scale_factor command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "scale_factor"
-          ],
-          "deny": []
-        }
-      },
-      "allow-scene-identifier": {
-        "identifier": "allow-scene-identifier",
-        "description": "Enables the scene_identifier command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "scene_identifier"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-always-on-bottom": {
-        "identifier": "allow-set-always-on-bottom",
-        "description": "Enables the set_always_on_bottom command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_always_on_bottom"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-always-on-top": {
-        "identifier": "allow-set-always-on-top",
-        "description": "Enables the set_always_on_top command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_always_on_top"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-background-color": {
-        "identifier": "allow-set-background-color",
-        "description": "Enables the set_background_color command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_background_color"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-badge-count": {
-        "identifier": "allow-set-badge-count",
-        "description": "Enables the set_badge_count command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_badge_count"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-badge-label": {
-        "identifier": "allow-set-badge-label",
-        "description": "Enables the set_badge_label command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_badge_label"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-closable": {
-        "identifier": "allow-set-closable",
-        "description": "Enables the set_closable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_closable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-content-protected": {
-        "identifier": "allow-set-content-protected",
-        "description": "Enables the set_content_protected command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_content_protected"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-cursor-grab": {
-        "identifier": "allow-set-cursor-grab",
-        "description": "Enables the set_cursor_grab command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_cursor_grab"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-cursor-icon": {
-        "identifier": "allow-set-cursor-icon",
-        "description": "Enables the set_cursor_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_cursor_icon"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-cursor-position": {
-        "identifier": "allow-set-cursor-position",
-        "description": "Enables the set_cursor_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_cursor_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-cursor-visible": {
-        "identifier": "allow-set-cursor-visible",
-        "description": "Enables the set_cursor_visible command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_cursor_visible"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-decorations": {
-        "identifier": "allow-set-decorations",
-        "description": "Enables the set_decorations command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_decorations"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-effects": {
-        "identifier": "allow-set-effects",
-        "description": "Enables the set_effects command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_effects"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-enabled": {
-        "identifier": "allow-set-enabled",
-        "description": "Enables the set_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_enabled"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-focus": {
-        "identifier": "allow-set-focus",
-        "description": "Enables the set_focus command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_focus"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-focusable": {
-        "identifier": "allow-set-focusable",
-        "description": "Enables the set_focusable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_focusable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-fullscreen": {
-        "identifier": "allow-set-fullscreen",
-        "description": "Enables the set_fullscreen command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_fullscreen"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-fullscreen-on-monitor": {
-        "identifier": "allow-set-fullscreen-on-monitor",
-        "description": "Enables the set_fullscreen_on_monitor command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_fullscreen_on_monitor"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-icon": {
-        "identifier": "allow-set-icon",
-        "description": "Enables the set_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_icon"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-ignore-cursor-events": {
-        "identifier": "allow-set-ignore-cursor-events",
-        "description": "Enables the set_ignore_cursor_events command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_ignore_cursor_events"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-max-size": {
-        "identifier": "allow-set-max-size",
-        "description": "Enables the set_max_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_max_size"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-maximizable": {
-        "identifier": "allow-set-maximizable",
-        "description": "Enables the set_maximizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_maximizable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-min-size": {
-        "identifier": "allow-set-min-size",
-        "description": "Enables the set_min_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_min_size"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-minimizable": {
-        "identifier": "allow-set-minimizable",
-        "description": "Enables the set_minimizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_minimizable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-overlay-icon": {
-        "identifier": "allow-set-overlay-icon",
-        "description": "Enables the set_overlay_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_overlay_icon"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-position": {
-        "identifier": "allow-set-position",
-        "description": "Enables the set_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_position"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-progress-bar": {
-        "identifier": "allow-set-progress-bar",
-        "description": "Enables the set_progress_bar command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_progress_bar"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-resizable": {
-        "identifier": "allow-set-resizable",
-        "description": "Enables the set_resizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_resizable"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-shadow": {
-        "identifier": "allow-set-shadow",
-        "description": "Enables the set_shadow command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_shadow"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-simple-fullscreen": {
-        "identifier": "allow-set-simple-fullscreen",
-        "description": "Enables the set_simple_fullscreen command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_simple_fullscreen"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-size": {
-        "identifier": "allow-set-size",
-        "description": "Enables the set_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_size"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-size-constraints": {
-        "identifier": "allow-set-size-constraints",
-        "description": "Enables the set_size_constraints command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_size_constraints"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-skip-taskbar": {
-        "identifier": "allow-set-skip-taskbar",
-        "description": "Enables the set_skip_taskbar command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_skip_taskbar"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-theme": {
-        "identifier": "allow-set-theme",
-        "description": "Enables the set_theme command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_theme"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-title": {
-        "identifier": "allow-set-title",
-        "description": "Enables the set_title command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_title"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-title-bar-style": {
-        "identifier": "allow-set-title-bar-style",
-        "description": "Enables the set_title_bar_style command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_title_bar_style"
-          ],
-          "deny": []
-        }
-      },
-      "allow-set-visible-on-all-workspaces": {
-        "identifier": "allow-set-visible-on-all-workspaces",
-        "description": "Enables the set_visible_on_all_workspaces command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "set_visible_on_all_workspaces"
-          ],
-          "deny": []
-        }
-      },
-      "allow-show": {
-        "identifier": "allow-show",
-        "description": "Enables the show command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "show"
-          ],
-          "deny": []
-        }
-      },
-      "allow-start-dragging": {
-        "identifier": "allow-start-dragging",
-        "description": "Enables the start_dragging command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "start_dragging"
-          ],
-          "deny": []
-        }
-      },
-      "allow-start-resize-dragging": {
-        "identifier": "allow-start-resize-dragging",
-        "description": "Enables the start_resize_dragging command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "start_resize_dragging"
-          ],
-          "deny": []
-        }
-      },
-      "allow-theme": {
-        "identifier": "allow-theme",
-        "description": "Enables the theme command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "theme"
-          ],
-          "deny": []
-        }
-      },
-      "allow-title": {
-        "identifier": "allow-title",
-        "description": "Enables the title command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "title"
-          ],
-          "deny": []
-        }
-      },
-      "allow-toggle-maximize": {
-        "identifier": "allow-toggle-maximize",
-        "description": "Enables the toggle_maximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "toggle_maximize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-unmaximize": {
-        "identifier": "allow-unmaximize",
-        "description": "Enables the unmaximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "unmaximize"
-          ],
-          "deny": []
-        }
-      },
-      "allow-unminimize": {
-        "identifier": "allow-unminimize",
-        "description": "Enables the unminimize command without any pre-configured scope.",
-        "commands": {
-          "allow": [
-            "unminimize"
-          ],
-          "deny": []
-        }
-      },
-      "deny-activity-name": {
-        "identifier": "deny-activity-name",
-        "description": "Denies the activity_name command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "activity_name"
-          ]
-        }
-      },
-      "deny-available-monitors": {
-        "identifier": "deny-available-monitors",
-        "description": "Denies the available_monitors command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "available_monitors"
-          ]
-        }
-      },
-      "deny-center": {
-        "identifier": "deny-center",
-        "description": "Denies the center command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "center"
-          ]
-        }
-      },
-      "deny-close": {
-        "identifier": "deny-close",
-        "description": "Denies the close command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "close"
-          ]
-        }
-      },
-      "deny-create": {
-        "identifier": "deny-create",
-        "description": "Denies the create command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "create"
-          ]
-        }
-      },
-      "deny-current-monitor": {
-        "identifier": "deny-current-monitor",
-        "description": "Denies the current_monitor command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "current_monitor"
-          ]
-        }
-      },
-      "deny-cursor-position": {
-        "identifier": "deny-cursor-position",
-        "description": "Denies the cursor_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "cursor_position"
-          ]
-        }
-      },
-      "deny-destroy": {
-        "identifier": "deny-destroy",
-        "description": "Denies the destroy command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "destroy"
-          ]
-        }
-      },
-      "deny-get-all-windows": {
-        "identifier": "deny-get-all-windows",
-        "description": "Denies the get_all_windows command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "get_all_windows"
-          ]
-        }
-      },
-      "deny-hide": {
-        "identifier": "deny-hide",
-        "description": "Denies the hide command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "hide"
-          ]
-        }
-      },
-      "deny-inner-position": {
-        "identifier": "deny-inner-position",
-        "description": "Denies the inner_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "inner_position"
-          ]
-        }
-      },
-      "deny-inner-size": {
-        "identifier": "deny-inner-size",
-        "description": "Denies the inner_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "inner_size"
-          ]
-        }
-      },
-      "deny-internal-toggle-maximize": {
-        "identifier": "deny-internal-toggle-maximize",
-        "description": "Denies the internal_toggle_maximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "internal_toggle_maximize"
-          ]
-        }
-      },
-      "deny-is-always-on-top": {
-        "identifier": "deny-is-always-on-top",
-        "description": "Denies the is_always_on_top command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_always_on_top"
-          ]
-        }
-      },
-      "deny-is-closable": {
-        "identifier": "deny-is-closable",
-        "description": "Denies the is_closable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_closable"
-          ]
-        }
-      },
-      "deny-is-decorated": {
-        "identifier": "deny-is-decorated",
-        "description": "Denies the is_decorated command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_decorated"
-          ]
-        }
-      },
-      "deny-is-enabled": {
-        "identifier": "deny-is-enabled",
-        "description": "Denies the is_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_enabled"
-          ]
-        }
-      },
-      "deny-is-focused": {
-        "identifier": "deny-is-focused",
-        "description": "Denies the is_focused command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_focused"
-          ]
-        }
-      },
-      "deny-is-fullscreen": {
-        "identifier": "deny-is-fullscreen",
-        "description": "Denies the is_fullscreen command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_fullscreen"
-          ]
-        }
-      },
-      "deny-is-maximizable": {
-        "identifier": "deny-is-maximizable",
-        "description": "Denies the is_maximizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_maximizable"
-          ]
-        }
-      },
-      "deny-is-maximized": {
-        "identifier": "deny-is-maximized",
-        "description": "Denies the is_maximized command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_maximized"
-          ]
-        }
-      },
-      "deny-is-minimizable": {
-        "identifier": "deny-is-minimizable",
-        "description": "Denies the is_minimizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_minimizable"
-          ]
-        }
-      },
-      "deny-is-minimized": {
-        "identifier": "deny-is-minimized",
-        "description": "Denies the is_minimized command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_minimized"
-          ]
-        }
-      },
-      "deny-is-resizable": {
-        "identifier": "deny-is-resizable",
-        "description": "Denies the is_resizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_resizable"
-          ]
-        }
-      },
-      "deny-is-visible": {
-        "identifier": "deny-is-visible",
-        "description": "Denies the is_visible command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "is_visible"
-          ]
-        }
-      },
-      "deny-maximize": {
-        "identifier": "deny-maximize",
-        "description": "Denies the maximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "maximize"
-          ]
-        }
-      },
-      "deny-minimize": {
-        "identifier": "deny-minimize",
-        "description": "Denies the minimize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "minimize"
-          ]
-        }
-      },
-      "deny-monitor-from-point": {
-        "identifier": "deny-monitor-from-point",
-        "description": "Denies the monitor_from_point command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "monitor_from_point"
-          ]
-        }
-      },
-      "deny-outer-position": {
-        "identifier": "deny-outer-position",
-        "description": "Denies the outer_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "outer_position"
-          ]
-        }
-      },
-      "deny-outer-size": {
-        "identifier": "deny-outer-size",
-        "description": "Denies the outer_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "outer_size"
-          ]
-        }
-      },
-      "deny-primary-monitor": {
-        "identifier": "deny-primary-monitor",
-        "description": "Denies the primary_monitor command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "primary_monitor"
-          ]
-        }
-      },
-      "deny-request-user-attention": {
-        "identifier": "deny-request-user-attention",
-        "description": "Denies the request_user_attention command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "request_user_attention"
-          ]
-        }
-      },
-      "deny-scale-factor": {
-        "identifier": "deny-scale-factor",
-        "description": "Denies the scale_factor command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "scale_factor"
-          ]
-        }
-      },
-      "deny-scene-identifier": {
-        "identifier": "deny-scene-identifier",
-        "description": "Denies the scene_identifier command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "scene_identifier"
-          ]
-        }
-      },
-      "deny-set-always-on-bottom": {
-        "identifier": "deny-set-always-on-bottom",
-        "description": "Denies the set_always_on_bottom command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_always_on_bottom"
-          ]
-        }
-      },
-      "deny-set-always-on-top": {
-        "identifier": "deny-set-always-on-top",
-        "description": "Denies the set_always_on_top command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_always_on_top"
-          ]
-        }
-      },
-      "deny-set-background-color": {
-        "identifier": "deny-set-background-color",
-        "description": "Denies the set_background_color command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_background_color"
-          ]
-        }
-      },
-      "deny-set-badge-count": {
-        "identifier": "deny-set-badge-count",
-        "description": "Denies the set_badge_count command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_badge_count"
-          ]
-        }
-      },
-      "deny-set-badge-label": {
-        "identifier": "deny-set-badge-label",
-        "description": "Denies the set_badge_label command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_badge_label"
-          ]
-        }
-      },
-      "deny-set-closable": {
-        "identifier": "deny-set-closable",
-        "description": "Denies the set_closable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_closable"
-          ]
-        }
-      },
-      "deny-set-content-protected": {
-        "identifier": "deny-set-content-protected",
-        "description": "Denies the set_content_protected command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_content_protected"
-          ]
-        }
-      },
-      "deny-set-cursor-grab": {
-        "identifier": "deny-set-cursor-grab",
-        "description": "Denies the set_cursor_grab command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_cursor_grab"
-          ]
-        }
-      },
-      "deny-set-cursor-icon": {
-        "identifier": "deny-set-cursor-icon",
-        "description": "Denies the set_cursor_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_cursor_icon"
-          ]
-        }
-      },
-      "deny-set-cursor-position": {
-        "identifier": "deny-set-cursor-position",
-        "description": "Denies the set_cursor_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_cursor_position"
-          ]
-        }
-      },
-      "deny-set-cursor-visible": {
-        "identifier": "deny-set-cursor-visible",
-        "description": "Denies the set_cursor_visible command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_cursor_visible"
-          ]
-        }
-      },
-      "deny-set-decorations": {
-        "identifier": "deny-set-decorations",
-        "description": "Denies the set_decorations command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_decorations"
-          ]
-        }
-      },
-      "deny-set-effects": {
-        "identifier": "deny-set-effects",
-        "description": "Denies the set_effects command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_effects"
-          ]
-        }
-      },
-      "deny-set-enabled": {
-        "identifier": "deny-set-enabled",
-        "description": "Denies the set_enabled command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_enabled"
-          ]
-        }
-      },
-      "deny-set-focus": {
-        "identifier": "deny-set-focus",
-        "description": "Denies the set_focus command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_focus"
-          ]
-        }
-      },
-      "deny-set-focusable": {
-        "identifier": "deny-set-focusable",
-        "description": "Denies the set_focusable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_focusable"
-          ]
-        }
-      },
-      "deny-set-fullscreen": {
-        "identifier": "deny-set-fullscreen",
-        "description": "Denies the set_fullscreen command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_fullscreen"
-          ]
-        }
-      },
-      "deny-set-fullscreen-on-monitor": {
-        "identifier": "deny-set-fullscreen-on-monitor",
-        "description": "Denies the set_fullscreen_on_monitor command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_fullscreen_on_monitor"
-          ]
-        }
-      },
-      "deny-set-icon": {
-        "identifier": "deny-set-icon",
-        "description": "Denies the set_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_icon"
-          ]
-        }
-      },
-      "deny-set-ignore-cursor-events": {
-        "identifier": "deny-set-ignore-cursor-events",
-        "description": "Denies the set_ignore_cursor_events command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_ignore_cursor_events"
-          ]
-        }
-      },
-      "deny-set-max-size": {
-        "identifier": "deny-set-max-size",
-        "description": "Denies the set_max_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_max_size"
-          ]
-        }
-      },
-      "deny-set-maximizable": {
-        "identifier": "deny-set-maximizable",
-        "description": "Denies the set_maximizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_maximizable"
-          ]
-        }
-      },
-      "deny-set-min-size": {
-        "identifier": "deny-set-min-size",
-        "description": "Denies the set_min_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_min_size"
-          ]
-        }
-      },
-      "deny-set-minimizable": {
-        "identifier": "deny-set-minimizable",
-        "description": "Denies the set_minimizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_minimizable"
-          ]
-        }
-      },
-      "deny-set-overlay-icon": {
-        "identifier": "deny-set-overlay-icon",
-        "description": "Denies the set_overlay_icon command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_overlay_icon"
-          ]
-        }
-      },
-      "deny-set-position": {
-        "identifier": "deny-set-position",
-        "description": "Denies the set_position command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_position"
-          ]
-        }
-      },
-      "deny-set-progress-bar": {
-        "identifier": "deny-set-progress-bar",
-        "description": "Denies the set_progress_bar command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_progress_bar"
-          ]
-        }
-      },
-      "deny-set-resizable": {
-        "identifier": "deny-set-resizable",
-        "description": "Denies the set_resizable command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_resizable"
-          ]
-        }
-      },
-      "deny-set-shadow": {
-        "identifier": "deny-set-shadow",
-        "description": "Denies the set_shadow command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_shadow"
-          ]
-        }
-      },
-      "deny-set-simple-fullscreen": {
-        "identifier": "deny-set-simple-fullscreen",
-        "description": "Denies the set_simple_fullscreen command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_simple_fullscreen"
-          ]
-        }
-      },
-      "deny-set-size": {
-        "identifier": "deny-set-size",
-        "description": "Denies the set_size command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_size"
-          ]
-        }
-      },
-      "deny-set-size-constraints": {
-        "identifier": "deny-set-size-constraints",
-        "description": "Denies the set_size_constraints command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_size_constraints"
-          ]
-        }
-      },
-      "deny-set-skip-taskbar": {
-        "identifier": "deny-set-skip-taskbar",
-        "description": "Denies the set_skip_taskbar command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_skip_taskbar"
-          ]
-        }
-      },
-      "deny-set-theme": {
-        "identifier": "deny-set-theme",
-        "description": "Denies the set_theme command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_theme"
-          ]
-        }
-      },
-      "deny-set-title": {
-        "identifier": "deny-set-title",
-        "description": "Denies the set_title command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_title"
-          ]
-        }
-      },
-      "deny-set-title-bar-style": {
-        "identifier": "deny-set-title-bar-style",
-        "description": "Denies the set_title_bar_style command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_title_bar_style"
-          ]
-        }
-      },
-      "deny-set-visible-on-all-workspaces": {
-        "identifier": "deny-set-visible-on-all-workspaces",
-        "description": "Denies the set_visible_on_all_workspaces command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "set_visible_on_all_workspaces"
-          ]
-        }
-      },
-      "deny-show": {
-        "identifier": "deny-show",
-        "description": "Denies the show command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "show"
-          ]
-        }
-      },
-      "deny-start-dragging": {
-        "identifier": "deny-start-dragging",
-        "description": "Denies the start_dragging command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "start_dragging"
-          ]
-        }
-      },
-      "deny-start-resize-dragging": {
-        "identifier": "deny-start-resize-dragging",
-        "description": "Denies the start_resize_dragging command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "start_resize_dragging"
-          ]
-        }
-      },
-      "deny-theme": {
-        "identifier": "deny-theme",
-        "description": "Denies the theme command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "theme"
-          ]
-        }
-      },
-      "deny-title": {
-        "identifier": "deny-title",
-        "description": "Denies the title command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "title"
-          ]
-        }
-      },
-      "deny-toggle-maximize": {
-        "identifier": "deny-toggle-maximize",
-        "description": "Denies the toggle_maximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "toggle_maximize"
-          ]
-        }
-      },
-      "deny-unmaximize": {
-        "identifier": "deny-unmaximize",
-        "description": "Denies the unmaximize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "unmaximize"
-          ]
-        }
-      },
-      "deny-unminimize": {
-        "identifier": "deny-unminimize",
-        "description": "Denies the unminimize command without any pre-configured scope.",
-        "commands": {
-          "allow": [],
-          "deny": [
-            "unminimize"
-          ]
-        }
-      }
-    },
-    "permission_sets": {},
-    "global_scope_schema": null
-  }
-}
+{"__app-acl__":{"default_permission":null,"permissions":{"allow-build-manifest":{"identifier":"allow-build-manifest","description":"Enables the build_manifest command without any pre-configured scope.","commands":{"allow":["build_manifest"],"deny":[]}},"allow-constitute-image":{"identifier":"allow-constitute-image","description":"Enables the constitute_image command without any pre-configured scope.","commands":{"allow":["constitute_image"],"deny":[]}},"allow-create-draft":{"identifier":"allow-create-draft","description":"Enables the create_draft command without any pre-configured scope.","commands":{"allow":["create_draft"],"deny":[]}},"allow-export-artifact":{"identifier":"allow-export-artifact","description":"Enables the export_artifact command without any pre-configured scope.","commands":{"allow":["export_artifact"],"deny":[]}},"allow-import-draft":{"identifier":"allow-import-draft","description":"Enables the import_draft command without any pre-configured scope.","commands":{"allow":["import_draft"],"deny":[]}},"allow-import-storage-snapshot":{"identifier":"allow-import-storage-snapshot","description":"Enables the import_storage_snapshot command without any pre-configured scope.","commands":{"allow":["import_storage_snapshot"],"deny":[]}},"allow-inspect-host-hardware":{"identifier":"allow-inspect-host-hardware","description":"Enables the inspect_host_hardware command without any pre-configured scope.","commands":{"allow":["inspect_host_hardware"],"deny":[]}},"allow-inspect-storage-devices":{"identifier":"allow-inspect-storage-devices","description":"Enables the inspect_storage_devices command without any pre-configured scope.","commands":{"allow":["inspect_storage_devices"],"deny":[]}},"allow-load-catalog":{"identifier":"allow-load-catalog","description":"Enables the load_catalog command without any pre-configured scope.","commands":{"allow":["load_catalog"],"deny":[]}},"allow-open-draft":{"identifier":"allow-open-draft","description":"Enables the open_draft command without any pre-configured scope.","commands":{"allow":["open_draft"],"deny":[]}},"allow-propose-storage-plan":{"identifier":"allow-propose-storage-plan","description":"Enables the propose_storage_plan command without any pre-configured scope.","commands":{"allow":["propose_storage_plan"],"deny":[]}},"allow-refresh-storage-snapshot":{"identifier":"allow-refresh-storage-snapshot","description":"Enables the refresh_storage_snapshot command without any pre-configured scope.","commands":{"allow":["refresh_storage_snapshot"],"deny":[]}},"allow-resolve-draft":{"identifier":"allow-resolve-draft","description":"Enables the resolve_draft command without any pre-configured scope.","commands":{"allow":["resolve_draft"],"deny":[]}},"allow-save-draft":{"identifier":"allow-save-draft","description":"Enables the save_draft command without any pre-configured scope.","commands":{"allow":["save_draft"],"deny":[]}},"allow-save-export-bytes":{"identifier":"allow-save-export-bytes","description":"Enables the save_export_bytes command without any pre-configured scope.","commands":{"allow":["save_export_bytes"],"deny":[]}},"allow-validate-draft":{"identifier":"allow-validate-draft","description":"Enables the validate_draft command without any pre-configured scope.","commands":{"allow":["validate_draft"],"deny":[]}},"allow-validate-storage-plan":{"identifier":"allow-validate-storage-plan","description":"Enables the validate_storage_plan command without any pre-configured scope.","commands":{"allow":["validate_storage_plan"],"deny":[]}},"deny-build-manifest":{"identifier":"deny-build-manifest","description":"Denies the build_manifest command without any pre-configured scope.","commands":{"allow":[],"deny":["build_manifest"]}},"deny-constitute-image":{"identifier":"deny-constitute-image","description":"Denies the constitute_image command without any pre-configured scope.","commands":{"allow":[],"deny":["constitute_image"]}},"deny-create-draft":{"identifier":"deny-create-draft","description":"Denies the create_draft command without any pre-configured scope.","commands":{"allow":[],"deny":["create_draft"]}},"deny-export-artifact":{"identifier":"deny-export-artifact","description":"Denies the export_artifact command without any pre-configured scope.","commands":{"allow":[],"deny":["export_artifact"]}},"deny-import-draft":{"identifier":"deny-import-draft","description":"Denies the import_draft command without any pre-configured scope.","commands":{"allow":[],"deny":["import_draft"]}},"deny-import-storage-snapshot":{"identifier":"deny-import-storage-snapshot","description":"Denies the import_storage_snapshot command without any pre-configured scope.","commands":{"allow":[],"deny":["import_storage_snapshot"]}},"deny-inspect-host-hardware":{"identifier":"deny-inspect-host-hardware","description":"Denies the inspect_host_hardware command without any pre-configured scope.","commands":{"allow":[],"deny":["inspect_host_hardware"]}},"deny-inspect-storage-devices":{"identifier":"deny-inspect-storage-devices","description":"Denies the inspect_storage_devices command without any pre-configured scope.","commands":{"allow":[],"deny":["inspect_storage_devices"]}},"deny-load-catalog":{"identifier":"deny-load-catalog","description":"Denies the load_catalog command without any pre-configured scope.","commands":{"allow":[],"deny":["load_catalog"]}},"deny-open-draft":{"identifier":"deny-open-draft","description":"Denies the open_draft command without any pre-configured scope.","commands":{"allow":[],"deny":["open_draft"]}},"deny-propose-storage-plan":{"identifier":"deny-propose-storage-plan","description":"Denies the propose_storage_plan command without any pre-configured scope.","commands":{"allow":[],"deny":["propose_storage_plan"]}},"deny-refresh-storage-snapshot":{"identifier":"deny-refresh-storage-snapshot","description":"Denies the refresh_storage_snapshot command without any pre-configured scope.","commands":{"allow":[],"deny":["refresh_storage_snapshot"]}},"deny-resolve-draft":{"identifier":"deny-resolve-draft","description":"Denies the resolve_draft command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_draft"]}},"deny-save-draft":{"identifier":"deny-save-draft","description":"Denies the save_draft command without any pre-configured scope.","commands":{"allow":[],"deny":["save_draft"]}},"deny-save-export-bytes":{"identifier":"deny-save-export-bytes","description":"Denies the save_export_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["save_export_bytes"]}},"deny-validate-draft":{"identifier":"deny-validate-draft","description":"Denies the validate_draft command without any pre-configured scope.","commands":{"allow":[],"deny":["validate_draft"]}},"deny-validate-storage-plan":{"identifier":"deny-validate-storage-plan","description":"Denies the validate_storage_plan command without any pre-configured scope.","commands":{"allow":[],"deny":["validate_storage_plan"]}}},"permission_sets":{},"global_scope_schema":null},"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-exit":{"identifier":"allow-exit","description":"Enables the exit command without any pre-configured scope.","commands":{"allow":["exit"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-exit":{"identifier":"deny-exit","description":"Denies the exit command without any pre-configured scope.","commands":{"allow":[],"deny":["exit"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-supports-multiple-windows":{"identifier":"deny-supports-multiple-windows","description":"Denies the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["supports_multiple_windows"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-icon-with-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-icon-with-as-template":{"identifier":"allow-set-icon-with-as-template","description":"Enables the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_with_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-icon-with-as-template":{"identifier":"deny-set-icon-with-as-template","description":"Denies the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_with_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-activity-name","allow-scene-identifier","allow-internal-toggle-maximize"]},"permissions":{"allow-activity-name":{"identifier":"allow-activity-name","description":"Enables the activity_name command without any pre-configured scope.","commands":{"allow":["activity_name"],"deny":[]}},"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-scene-identifier":{"identifier":"allow-scene-identifier","description":"Enables the scene_identifier command without any pre-configured scope.","commands":{"allow":["scene_identifier"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-fullscreen-on-monitor":{"identifier":"allow-set-fullscreen-on-monitor","description":"Enables the set_fullscreen_on_monitor command without any pre-configured scope.","commands":{"allow":["set_fullscreen_on_monitor"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-activity-name":{"identifier":"deny-activity-name","description":"Denies the activity_name command without any pre-configured scope.","commands":{"allow":[],"deny":["activity_name"]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-scene-identifier":{"identifier":"deny-scene-identifier","description":"Denies the scene_identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["scene_identifier"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-fullscreen-on-monitor":{"identifier":"deny-set-fullscreen-on-monitor","description":"Denies the set_fullscreen_on_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen_on_monitor"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null}}
\ No newline at end of file
diff --git a/src-tauri/gen/schemas/capabilities.json b/src-tauri/gen/schemas/capabilities.json
index 2ef472a..e6fd10f 100644
--- a/src-tauri/gen/schemas/capabilities.json
+++ b/src-tauri/gen/schemas/capabilities.json
@@ -1 +1 @@
-{"main-capability":{"identifier":"main-capability","description":"Ventana main: CorePort + guardado nativo acotado (save_export_bytes). Sin shell ni FS global.","local":true,"windows":["main"],"permissions":["allow-create-draft","allow-load-catalog","allow-save-draft","allow-open-draft","allow-resolve-draft","allow-validate-draft","allow-build-manifest","allow-export-artifact","allow-import-draft","allow-save-export-bytes","allow-inspect-host-hardware","allow-inspect-storage-devices","allow-refresh-storage-snapshot","allow-propose-storage-plan","allow-validate-storage-plan","allow-import-storage-snapshot"]},"restricted-capability":{"identifier":"restricted-capability","description":"Ventana de prueba ACL: sin permisos de comandos propios.","local":true,"windows":["restricted"],"permissions":[]}}
\ No newline at end of file
+{"main-capability":{"identifier":"main-capability","description":"Ventana main: CorePort + guardado nativo acotado (save_export_bytes). Sin shell ni FS global.","local":true,"windows":["main"],"permissions":["allow-create-draft","allow-load-catalog","allow-save-draft","allow-open-draft","allow-resolve-draft","allow-validate-draft","allow-build-manifest","allow-export-artifact","allow-import-draft","allow-save-export-bytes","allow-inspect-host-hardware","allow-inspect-storage-devices","allow-refresh-storage-snapshot","allow-propose-storage-plan","allow-validate-storage-plan","allow-import-storage-snapshot","allow-constitute-image"]},"restricted-capability":{"identifier":"restricted-capability","description":"Ventana de prueba ACL: sin permisos de comandos propios.","local":true,"windows":["restricted"],"permissions":[]}}
\ No newline at end of file
diff --git a/src-tauri/gen/schemas/desktop-schema.json b/src-tauri/gen/schemas/desktop-schema.json
index f7c8852..f915e1d 100644
--- a/src-tauri/gen/schemas/desktop-schema.json
+++ b/src-tauri/gen/schemas/desktop-schema.json
@@ -182,6 +182,12 @@
           "const": "allow-build-manifest",
           "markdownDescription": "Enables the build_manifest command without any pre-configured scope."
         },
+        {
+          "description": "Enables the constitute_image command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-constitute-image",
+          "markdownDescription": "Enables the constitute_image command without any pre-configured scope."
+        },
         {
           "description": "Enables the create_draft command without any pre-configured scope.",
           "type": "string",
@@ -278,6 +284,12 @@
           "const": "deny-build-manifest",
           "markdownDescription": "Denies the build_manifest command without any pre-configured scope."
         },
+        {
+          "description": "Denies the constitute_image command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-constitute-image",
+          "markdownDescription": "Denies the constitute_image command without any pre-configured scope."
+        },
         {
           "description": "Denies the create_draft command without any pre-configured scope.",
           "type": "string",
diff --git a/src-tauri/gen/schemas/linux-schema.json b/src-tauri/gen/schemas/linux-schema.json
index f7c8852..f915e1d 100644
--- a/src-tauri/gen/schemas/linux-schema.json
+++ b/src-tauri/gen/schemas/linux-schema.json
@@ -182,6 +182,12 @@
           "const": "allow-build-manifest",
           "markdownDescription": "Enables the build_manifest command without any pre-configured scope."
         },
+        {
+          "description": "Enables the constitute_image command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-constitute-image",
+          "markdownDescription": "Enables the constitute_image command without any pre-configured scope."
+        },
         {
           "description": "Enables the create_draft command without any pre-configured scope.",
           "type": "string",
@@ -278,6 +284,12 @@
           "const": "deny-build-manifest",
           "markdownDescription": "Denies the build_manifest command without any pre-configured scope."
         },
+        {
+          "description": "Denies the constitute_image command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-constitute-image",
+          "markdownDescription": "Denies the constitute_image command without any pre-configured scope."
+        },
         {
           "description": "Denies the create_draft command without any pre-configured scope.",
           "type": "string",
diff --git a/src-tauri/permissions/autogenerated/constitute_image.toml b/src-tauri/permissions/autogenerated/constitute_image.toml
new file mode 100644
index 0000000..8e9464e
--- /dev/null
+++ b/src-tauri/permissions/autogenerated/constitute_image.toml
@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-constitute-image"
+description = "Enables the constitute_image command without any pre-configured scope."
+commands.allow = ["constitute_image"]
+
+[[permission]]
+identifier = "deny-constitute-image"
+description = "Denies the constitute_image command without any pre-configured scope."
+commands.deny = ["constitute_image"]
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 64b14ee..41c7f06 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -53,6 +53,50 @@ fn gate_save_export(window: &tauri::Window) -> Result<(), serde_json::Value> {
     }
 }
 
+fn gate_constitute_image(window: &tauri::Window) -> Result<(), serde_json::Value> {
+    let label = window.label();
+    match Window::parse(label) {
+        Some(Window::Main) => Ok(()),
+        Some(other) => Err(core_error_value(CoreError::proto_denied(&format!(
+            "archmaker-invoke.{}.constitute_image",
+            other.as_str()
+        )))),
+        None => Err(core_error_value(unknown_command_error(
+            label,
+            "constitute_image",
+        ))),
+    }
+}
+
+fn constitution_payload(code: &str) -> serde_json::Value {
+    let message_key = match code {
+        archmaker_constitute::CODE_IMAGE_ABSENT => "error.constitution.mkarchisoAbsent",
+        archmaker_constitute::CODE_IMAGE_REFUSED => "error.constitution.mkarchisoRefused",
+        archmaker_constitute::CODE_SCRIPT => "error.constitution.scriptRejected",
+        _ => "error.constitution.unavailable",
+    };
+    serde_json::json!({
+        "code": code,
+        "family": "CONST",
+        "category": "contract",
+        "severity": "error",
+        "retryable": false,
+        "messageKey": message_key,
+        "source": "archmaker-constitute",
+    })
+}
+
+/// La página no elige ruta ni script. Un objeto vacío pide la imagen;
+/// cualquier otro payload se rechaza. Nunca ejecuta `mkarchiso`.
+fn constitute_image_decision(input: &serde_json::Value, search_path: &str) -> serde_json::Value {
+    let empty = matches!(input, serde_json::Value::Object(map) if map.is_empty());
+    if !empty {
+        return constitution_payload(archmaker_constitute::CODE_SCRIPT);
+    }
+    let err = archmaker_constitute::request_live_image(search_path);
+    constitution_payload(err.code)
+}
+
 fn parse_input<T>(op: CoreOp, input: serde_json::Value) -> Result<T, serde_json::Value>
 where
     T: serde::de::DeserializeOwned,
@@ -143,6 +187,18 @@ fn save_export_bytes(
         .map_err(core_error_value)
 }
 
+/// Pide la imagen viva. No acepta ruta, script ni directorio.
+/// Siempre falla de forma tipada: este proceso no lanza `mkarchiso`.
+#[tauri::command]
+fn constitute_image(
+    window: tauri::Window,
+    input: serde_json::Value,
+) -> Result<serde_json::Value, serde_json::Value> {
+    gate_constitute_image(&window)?;
+    let search = std::env::var("PATH").unwrap_or_default();
+    Err(constitute_image_decision(&input, &search))
+}
+
 /// Arranque de producción (runtime Wry).
 pub fn run() {
     tauri::Builder::default()
@@ -169,6 +225,7 @@ pub fn run() {
             export_artifact,
             import_draft,
             save_export_bytes,
+            constitute_image,
             hardware_ipc::inspect_host_hardware,
             hardware_ipc::inspect_storage_devices,
             hardware_ipc::refresh_storage_snapshot,
@@ -323,6 +380,63 @@ mod tests {
         );
     }
 
+    #[test]
+    fn constitute_image_denied_on_restricted_window() {
+        let app = tauri::test::mock_builder()
+            .build(tauri::generate_context!())
+            .expect("mock app");
+        let restricted = WebviewWindowBuilder::new(&app, "restricted", Default::default())
+            .build()
+            .expect("restricted");
+        let err = tauri::test::get_ipc_response(
+            &restricted,
+            InvokeRequest {
+                cmd: "constitute_image".into(),
+                callback: tauri::ipc::CallbackFn(0),
+                error: tauri::ipc::CallbackFn(1),
+                url: invoke_url(),
+                body: tauri::ipc::InvokeBody::default(),
+                headers: Default::default(),
+                invoke_key: tauri::test::INVOKE_KEY.to_string(),
+            },
+        )
+        .expect_err("restricted must not request the image");
+        assert!(
+            is_acl_denial(&err),
+            "expected ACL denial for constitute_image, got: {err:?}"
+        );
+    }
+
+    #[test]
+    fn constitute_image_decision_does_not_create_files_or_accept_a_script() {
+        let dir =
+            std::env::temp_dir().join(format!("archmaker-constitute-image-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let search = dir.to_str().expect("utf8");
+
+        let absent = super::constitute_image_decision(&serde_json::json!({}), search);
+        assert_eq!(absent["code"], "constitution-mkarchiso-absent");
+        assert_eq!(absent["messageKey"], "error.constitution.mkarchisoAbsent");
+        assert_eq!(absent["source"], "archmaker-constitute");
+        assert!(std::fs::read_dir(&dir).unwrap().next().is_none());
+
+        let tool = dir.join("mkarchiso");
+        std::fs::write(&tool, b"not-executed\n").unwrap();
+        let refused = super::constitute_image_decision(&serde_json::json!({}), search);
+        assert_eq!(refused["code"], "constitution-mkarchiso-refused");
+        assert_eq!(refused["messageKey"], "error.constitution.mkarchisoRefused");
+        assert_eq!(std::fs::read(&tool).unwrap(), b"not-executed\n");
+        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
+
+        let script =
+            super::constitute_image_decision(&serde_json::json!({"path": "/tmp/run.sh"}), search);
+        assert_eq!(script["code"], "constitution-script-rejected");
+        assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn save_export_bytes_unknown_command_and_dead_transport_surface() {
         let app = tauri::test::mock_builder()
diff --git a/tools/check_negative_capabilities.py b/tools/check_negative_capabilities.py
index 5979991..c378cc9 100644
--- a/tools/check_negative_capabilities.py
+++ b/tools/check_negative_capabilities.py
@@ -38,7 +38,7 @@ def check(name: str, ok: bool, detail: str = "") -> None:
     "validate_storage_plan",
     "import_storage_snapshot",
 ]
-APP_CMDS = CORE_CMDS + ["save_export_bytes"] + HW_CMDS
+APP_CMDS = CORE_CMDS + ["save_export_bytes", "constitute_image"] + HW_CMDS
 
 build_rs = (ROOT / "src-tauri/build.rs").read_text()
 check(
@@ -53,9 +53,10 @@ def check(name: str, ok: bool, detail: str = "") -> None:
 perms = cap.get("permissions") or []
 check(
     "NEG-001 main concede CorePort + save_export + hardware probe",
-    len(perms) == 16
+    len(perms) == 17
     and all(isinstance(p, str) and p.startswith("allow-") for p in perms)
     and "allow-save-export-bytes" in perms
+    and "allow-constitute-image" in perms
     and "allow-inspect-host-hardware" in perms,
     str(perms),
 )