- Install /etc/openchamber/policy.json (enterpriseMode, organization,
pinned relayUrl); sudo with OPENCHAMBER_ENTERPRISE_MODE=1 env fallback;
--no-enterprise opt-out
- Inject OpenCode provider policies into the synced config: deny all
providers, allow those derived from the config's own providers block,
BASELINE_ALLOWED_PROVIDERS (openai via codex-auth plugin), and
repeatable --allow-provider extras (e.g. constellation)
- Extend verification: policy file state, pinned relay, effective
provider allow-list
- Restructure into sourceable functions with a main guard so the policy
and merge logic is testable
c4ch3c4d3