Ask the user to grant a filesystem to this app — the §8.6 powerbox. The app asks; the HOST shows the user their spaces and, for the chosen one, its PROJECT FOLDERS (§8.7). The user picks ONE project — so a shared space opens scoped to just that project, never the whole space — and makes an EXPLICIT read-only vs read-write decision (there is no default). The app never sees the list; it resolves with the single granted mount, or rejects with a SpaceError (cancelled) if declined. The granted scope is enforced host-side: the mount is chroot'd to the project folder and ro-limited accordingly, so paths outside the project are unnameable and writes on a ro grant fail EROFS.

A project folder is the macOS-bundle-like unit an app works in inside a space; the host records which app a folder belongs to (a .immediately.run/ sidecar), so the picker can surface the app's own projects or let the user create a new one. Observe the granted access via SandboxMount.mode.

Backend-general (§3.5): the picker offers whatever mounts the user has (today, their spaces). Returns the granted mount by its universal id.