agentHost: drop the graduated bridge gate from docs and protocol tests

Follow-up to the gate graduation, from PR review:

- The managed-settings skill guidance still listed the false-by-default
  experimental gate as a bridge invariant, which would instruct future work to
  restore the removed gate. Updated in sdk-runtime-policy.md, and in the two
  further places carrying the same claim (legacy-permission-policy.md and
  SKILL.md).
- The protocol-boundary tests still supplied the deprecated opt-in to their
  forwarding fixtures, so they did not prove a local connection forwards
  restrictions without it. Removed, along with the now-unused import.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: joshspicer

.github/skills/policy-and-managed-settings/SKILL.md

@@ -37,9 +37,8 @@ General rules:
 - New Copilot enterprise controls should target the shared managed-settings/SDK model.
 - The VS Code settings-to-managed-settings bridge is a compatibility path for legacy
   settings only. Do not add a new VS Code setting in order to bridge it; define new
-  runtime-owned controls directly in the managed-settings/SDK contract. A temporary,
-  false-by-default compatibility gate for the bridge itself is allowed; it is not a
-  runtime control and must not become a template for new mapped settings.
+  runtime-owned controls directly in the managed-settings/SDK contract. The bridge itself
+  is unconditional; do not reintroduce a compatibility gate for it.
 - Run `npm run export-policy-data` for every VS Code or extension policy change. Never
   edit `build/lib/policies/policyData.jsonc` manually.
 

.github/skills/policy-and-managed-settings/legacy-permission-policy.md

@@ -17,9 +17,8 @@ There are two related but distinct bounded migrations:
 
 Neither path is open to newly designed settings or controls. Put new runtime-owned
 controls directly in the shared managed-settings schema and SDK contract.
-The legacy-setting bridge may have a false-by-default experimental gate for staged
-adoption; that gate controls the compatibility mechanism itself and is not a mapped
-runtime control.
+The legacy-setting bridge is unconditional; its former staged-adoption gate has been
+retired now that the bridge is the default enforcement path.
 
 ## Legacy permission policy rules
 

.github/skills/policy-and-managed-settings/sdk-runtime-policy.md

@@ -59,7 +59,7 @@ public SDK contract, without introducing or translating a VS Code setting.
 
 Bridge invariants:
 
-- the bridge is guarded by its own false-by-default experimental compatibility setting;
+- the bridge is unconditional; it is not guarded by an opt-in setting. `chat.agentHost.copilot.mapLegacySettingsToManagedSettings` is retained only so existing entries do not read as unknown, and its value is ignored;
 - add mappings only for legacy settings that already exist; never create a new setting
   for this bridge;
 - mappings select one VS Code setting and use a callback typed against the host-owned managed

src/vs/platform/agentHost/test/electron-browser/agentHostProtocolClient.test.ts

@@ -35,7 +35,6 @@ import { TestConfigurationService } from '../../../configuration/test/common/tes
 import { ITelemetryService, TelemetryConfiguration, TelemetryLevel, TELEMETRY_SETTING_ID } from '../../../telemetry/common/telemetry.js';
 import { NullTelemetryService } from '../../../telemetry/common/telemetryUtils.js';
 import { AgentHostDisableRepoInfoTelemetryConfigKey, AgentHostTelemetryLevelConfigKey, AgentHostTerminalAutoApproveRulesConfigKey, DISABLE_REPO_INFO_TELEMETRY_SETTING_ID, ELIGIBLE_FOR_AUTO_APPROVAL_SETTING_ID, GLOBAL_AUTO_APPROVE_SETTING_ID, telemetryLevelToAgentHostConfigValue, TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID, TERMINAL_AUTO_APPROVE_SETTING_ID, TERMINAL_IGNORE_DEFAULT_AUTO_APPROVE_RULES_SETTING_ID, type AgentHostTerminalAutoApproveRules } from '../../common/agentHostSchema.js';
-import { AgentHostMapLegacySettingsToManagedSettingsSettingId } from '../../common/agentHostManagedSettings.js';
 import { AgentHostConfigurationSyncScope, Extensions as ConfigurationExtensions, IConfigurationRegistry } from '../../../configuration/common/configurationRegistry.js';
 import { Registry } from '../../../registry/common/platform.js';
 
@@ -1267,7 +1266,6 @@ suite('AgentHostProtocolClient', () => {
 
 	test('forwards and clears legacy managed permissions for the local host', async () => {
 		const configurationService = new ManagedPermissionsConfigurationService({
-			[AgentHostMapLegacySettingsToManagedSettingsSettingId]: true,
 			[TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID]: false,
 		});
 		const { client, transport } = createClientForIdentity(
@@ -1307,9 +1305,7 @@ suite('AgentHostProtocolClient', () => {
 	});
 
 	test('forwards and clears the mapped per-tool auto-approval policy for the local host', async () => {
-		const configurationService = new ManagedPermissionsConfigurationService({
-			[AgentHostMapLegacySettingsToManagedSettingsSettingId]: true,
-		});
+		const configurationService = new ManagedPermissionsConfigurationService({});
 		// Isolate this setting's notification path from the global auto-approve mapping.
 		configurationService.clearGlobalAutoApprovePolicy();
 		configurationService.setEligibleForAutoApprovalPolicy({ runTask: false });