diff --git a/DESIGN.md b/DESIGN.md
index ed739ce0..75f53dcf 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -1189,6 +1189,8 @@ Run after phases 1 to 5 and again before every release, as its own change set.
 
 - **Release 1 — first public Avalonia build (published 2026-10-08).** PR #1 merged as `89bd54e`, and tag [`v2026.10.08-89bd54e`](https://github.com/jay23606/codev/releases/tag/v2026.10.08-89bd54e) is the latest public release. The tag workflow [completed successfully](https://github.com/jay23606/codev/actions/runs/37803303950), publishing Windows x64, Linux x64, macOS Apple silicon, and macOS Intel app and CLI archives. Main-branch CI [passed](https://github.com/jay23606/codev/actions/runs/37803227210); the exact-head package preview passed on all four targets before publication. The release body documents Auto-mode permissions, preview limitations, and setup. Hosted launch and interaction checks do not replace clean-machine installation; a local exact-artifact attempt reached MCP settings but Windows focus moved to the lock screen before composer verification, so clean-machine interaction remains unverified.
 **Release archive prepublish gate (2026-10-09, PR #74, merged as `35897d6`).** The tag and manual preview workflow now verifies the exact eight desktop/CLI ZIPs, tests each archive, and checks its platform executable before a release can publish. The extracted Bash check passed an eight-archive fixture and rejected missing, extra, corrupt, and wrong-executable fixtures; PR Windows/Linux/macOS CI [#38001121514](https://github.com/jay23606/codev/actions/runs/38001121514) passed. The desktop preview workflow no longer runs packaged interaction smokes on every pull request; routine PR validation stays in the Windows/Linux/macOS CI matrix. The four-target packaged preview runs only by manual dispatch at the planned October 11 freeze or for a version tag, reducing repeated UI interaction checks while retaining candidate and release gates. No packaged UI smoke was run for this workflow-only change.
+
+**Auto/profile/MCP denial composition review (2026-10-09, product head `7cb7d2b`).** The executor returns immediately for profile Deny before dispatching a tool, and MainViewModel evaluates a saved project MCP Deny before Auto or a one-call profile approval can approve the operation. If the MCP permission store is unavailable, it cannot be bypassed by a profile approval; the call falls back to explicit per-call approval. Focused Core tests for profile Deny and exact MCP Deny in Auto passed 2/2; Avalonia headless tests for Auto MCP execution and the unavailable-store approval fallback passed 2/2. PR #77 Windows/Linux/macOS CI [#38003412218](https://github.com/jay23606/codev/actions/runs/38003412218) and post-merge CI [#38003676335](https://github.com/jay23606/codev/actions/runs/38003676335) passed. No policy bypass was found in these paths; hosted OAuth and native macOS/Linux UI checks remain open.
 - The README's latest-release links now resolve to Release 1. Native Linux/macOS accessibility and physical-device interaction have not been manually verified; the hosted UI checks passed, and native checks remain follow-up work. Preserve the existing `vYYYY.MM.DD-<sha>` tag style and describe this as the first public Avalonia preview, not a stability claim.
 - **Release 2 — feedback patch.** Target 3–5 days after Release 1. Triage actual reports, fix only regressions or high-impact usability issues, and rerun the same release gate. Include the first native Mac/Linux interaction checks that can be completed, plus the highest-value deferred smoke cases. Keep larger parity features on their own backlog rather than expanding this patch.
 - **Avalonia 12 accessibility-upgrade feasibility (2026-10-08, isolated spike, code head `149fa5c`).** Avalonia 12.1.3 exposes Linux AT-SPI support when the desktop session provides D-Bus and an accessibility service, so it could close a documented Linux accessibility gap. A separate worktree upgraded the app and headless tests to Avalonia 12.1.3, used the available Markdown.Avalonia 12 prerelease, and migrated the test project to xUnit v3. Setting `AvaloniaUseCompiledBindingsByDefault` to `false` restores the attached-project Auto-label and expanded background-command tests that use mock view models; this preserves prior binding behavior while deferring a compiled-binding migration. Capping the Plan/Code task header buttons at 12px keeps the header compact at maximum font size. The full Avalonia suite passes: 64 passed, 0 failed, and 12 opt-in live tests skipped. Avalonia 12 did not reliably jump from the transcript end to a distant virtualized message with `ItemsControl.ScrollIntoView` alone; estimating the target offset, laying out there, and then calling `ScrollIntoView` fixes the regression. The strengthened UI test covers an earlier result in a transcript with uneven message lengths. Windows/Linux/macOS CI [#37752698065](https://github.com/jay23606/codev/actions/runs/37752698065) passed at review head `62d95c2`, including Avalonia headless UI tests on all three operating systems, portable test matrices, and the Windows credential-vault smoke. The four-RID package preview at code head `fc25aeb` [#37750507228](https://github.com/jay23606/codev/actions/runs/37750507228) passed for win-x64, linux-x64, osx-arm64, and osx-x64, including packaged Auto/local-chat interaction checks; publishing was skipped because this is an unmerged spike branch. Its Linux packaged check starts the app in a D-Bus session under Xvfb and queries the AT-SPI tree, finding the composer and send button by their accessible names. At code head `149fa5c`, the follow-up Linux check [#37751492456](https://github.com/jay23606/codev/actions/runs/37751492456) also found Search conversations and confirmed AT-SPI reports it focused after Ctrl+F; the complete four-RID package preview passed for Windows x64, Linux x64, macOS Apple silicon, and macOS Intel, with publishing skipped for the unmerged spike. A later packaged preview added Orca to the Linux Xvfb session and verified its debug trace processed the Search conversations focus event. The exact-head four-platform preview [#37758589411](https://github.com/jay23606/codev/actions/runs/37758589411) passed at `c833799`; Windows, Linux, Apple silicon, and Intel package checks succeeded, while public release publishing was skipped for the unmerged spike. This verifies that Orca processed the AT-SPI focus event in the hosted session, not that the field's label was spoken; native screen-reader speech, Markdown rendering, and behavior on a native desktop remain unverified. Keep the migration out of Release 1. Rebased follow-up head `b4c57de` was revalidated on 2026-10-08: [Windows CI](https://github.com/jay23606/codev/actions/runs/37805789384) passed the portable suites and Avalonia headless UI on Windows, Linux, and macOS; the [four-RID package preview](https://github.com/jay23606/codev/actions/runs/37805793301) passed packaged Windows, Linux, Apple silicon, and Intel app/CLI checks. Linux additionally passed AT-SPI control/focus assertions and Orca focus-event processing. The release-publish job was skipped because this was a manual preview run. The post-xUnit-v3 live Orchestrator regression was in the test attribute, not the app: its custom opt-in fact had stopped using Avalonia's dispatcher-aware discoverer. Applying `AvaloniaFactDiscoverer` via xUnit v3's `XunitTestCaseDiscovererAttribute` restored UI-thread execution, and the real Qwen3.6 run passed in 57 seconds with two Ask children running concurrently in distinct managed worktrees and reading their separate fixture values. At code head `b356146`, exact-head Windows/Linux/macOS CI [#37841615978](https://github.com/jay23606/codev/actions/runs/37841615978) and the four-RID packaged preview [#37841615852](https://github.com/jay23606/codev/actions/runs/37841615852) passed; publishing skipped because PR #10 is unmerged. PR #10 merged on 2026-10-08; spoken screen-reader output on physical desktops, Markdown rendering, and native interaction remain follow-up checks before a release decision.