# 03 — Control the APT Target

**What to build:** An APT Target that persistently applies the Active Profile on Debian-family systems, preserves pre-existing APT proxy behavior, and reports real configuration and permission outcomes through the common Target experience.

**Blocked by:** 02 — Safely control the Shell Target.

**Status:** in-progress

- [ ] APT is Available only when the expected Debian-family tooling and configuration capability are detected.
- [ ] The Target explanation states that APT supports proxy environment variables and that this integration provides persistent, privilege-boundary-safe configuration.
- [ ] Enabling uses an isolated `proxyctl`-owned overlay wherever supported and does not rewrite unrelated APT configuration.
- [ ] Disabling removes only the managed overlay and restores any previously effective recognized configuration.
- [ ] Inspection reports Enabled when effective managed values match the Active Profile, External for recognized non-managed proxy settings, Drifted for mismatched managed settings, and Disabled otherwise.
- [ ] Supported Profile protocol values and Bypass entries are translated without silently omitting data.
- [ ] An incompatible protocol or Bypass entry prevents mutation and identifies the incompatible value.
- [ ] Missing write authority produces immediate permission feedback and leaves or re-inspects the actual state.
- [ ] Repeated enable and disable operations are idempotent.
- [ ] Adapter contract and Target-specific tests use an isolated filesystem and fake APT command behavior; they never modify host package-manager configuration.