diff --git a/desktop/src/apps/SandboxedAppWindow.tsx b/desktop/src/apps/SandboxedAppWindow.tsx
index cf03a912..4d6c7b44 100644
--- a/desktop/src/apps/SandboxedAppWindow.tsx
+++ b/desktop/src/apps/SandboxedAppWindow.tsx
@@ -1,9 +1,12 @@
 // desktop/src/apps/SandboxedAppWindow.tsx
 import { useEffect, useRef } from "react";
+import { useThemeStore } from "@/stores/theme-store";
+import { ALLOWED_TOKENS } from "@/theme/theme-config";
 
 interface Props {
   windowId: string;
   appId: string;
+  trust?: "community" | "first-party";
 }
 
 interface BrokerRequest {
@@ -13,8 +16,42 @@ interface BrokerRequest {
   args?: Record<string, unknown>;
 }
 
-export function SandboxedAppWindow({ appId }: Props) {
+/** Read all ALLOWED_TOKENS CSS variables off :root and return as a plain object. */
+function readThemeTokens(): Record<string, string> {
+  if (typeof document === "undefined") return {};
+  const style = getComputedStyle(document.documentElement);
+  const tokens: Record<string, string> = {};
+  for (const token of ALLOWED_TOKENS) {
+    const value = style.getPropertyValue(token).trim();
+    if (value) tokens[token] = value;
+  }
+  return tokens;
+}
+
+export function SandboxedAppWindow({ appId, trust = "community" }: Props) {
   const iframeRef = useRef<HTMLIFrameElement>(null);
+  const isFirstParty = trust === "first-party";
+  // Subscribe to scheme changes (which fire on any applyThemeConfig call) so we
+  // can push updated tokens when the theme changes. The selector is minimal to
+  // avoid re-renders on unrelated store updates.
+  const scheme = useThemeStore((s) => s.scheme);
+
+  // Post theme tokens into the iframe for first-party apps.
+  useEffect(() => {
+    if (!isFirstParty) return;
+    const iframe = iframeRef.current;
+    if (!iframe?.contentWindow) return;
+    iframe.contentWindow.postMessage({ taosTheme: readThemeTokens() }, "*");
+  }, [isFirstParty, scheme]);
+
+  // Also post tokens once when the iframe loads (the scheme effect may fire
+  // before the frame is ready on the first render).
+  function handleLoad() {
+    if (!isFirstParty) return;
+    const iframe = iframeRef.current;
+    if (!iframe?.contentWindow) return;
+    iframe.contentWindow.postMessage({ taosTheme: readThemeTokens() }, "*");
+  }
 
   useEffect(() => {
     async function onMessage(e: MessageEvent) {
@@ -59,6 +96,7 @@ export function SandboxedAppWindow({ appId }: Props) {
       src={`/api/userspace-apps/${encodeURIComponent(appId)}/bundle/index.html?app=${encodeURIComponent(appId)}`}
       sandbox="allow-scripts"
       className="w-full h-full border-0 bg-white"
+      onLoad={handleLoad}
     />
   );
 }
diff --git a/desktop/src/apps/__tests__/SandboxedAppWindow.test.tsx b/desktop/src/apps/__tests__/SandboxedAppWindow.test.tsx
index ad077ddb..d3e4c32b 100644
--- a/desktop/src/apps/__tests__/SandboxedAppWindow.test.tsx
+++ b/desktop/src/apps/__tests__/SandboxedAppWindow.test.tsx
@@ -3,6 +3,17 @@ import { describe, it, expect, vi, afterEach } from "vitest";
 import { render, screen, waitFor } from "@testing-library/react";
 import { SandboxedAppWindow } from "../SandboxedAppWindow";
 
+// Mock the theme store -- the component subscribes to it.
+vi.mock("@/stores/theme-store", () => ({
+  useThemeStore: (sel: (s: { scheme: "light" | "dark" }) => unknown) =>
+    sel({ scheme: "dark" }),
+}));
+
+// Mock ALLOWED_TOKENS to a small known set so readThemeTokens is predictable.
+vi.mock("@/theme/theme-config", () => ({
+  ALLOWED_TOKENS: new Set(["--color-accent", "--color-shell-bg"]),
+}));
+
 afterEach(() => vi.unstubAllGlobals());
 
 describe("SandboxedAppWindow", () => {
@@ -67,3 +78,97 @@ describe("SandboxedAppWindow", () => {
     }
   });
 });
+
+describe("SandboxedAppWindow -- theme injection", () => {
+  it("posts taosTheme tokens on load for a first-party app", async () => {
+    render(<SandboxedAppWindow windowId="w1" appId="fp-app" trust="first-party" />);
+    const iframe = screen.getByTitle("fp-app") as HTMLIFrameElement;
+    const post = vi.fn();
+    Object.defineProperty(iframe, "contentWindow", { value: { postMessage: post }, configurable: true });
+
+    // Simulate the iframe load event.
+    iframe.dispatchEvent(new Event("load"));
+
+    await waitFor(() => {
+      expect(post).toHaveBeenCalled();
+      const call = post.mock.calls[0];
+      expect(call[0]).toHaveProperty("taosTheme");
+      expect(typeof call[0].taosTheme).toBe("object");
+    });
+  });
+
+  it("does NOT post taosTheme for a community app on load", () => {
+    render(<SandboxedAppWindow windowId="w2" appId="comm-app" trust="community" />);
+    const iframe = screen.getByTitle("comm-app") as HTMLIFrameElement;
+    const post = vi.fn();
+    Object.defineProperty(iframe, "contentWindow", { value: { postMessage: post }, configurable: true });
+
+    iframe.dispatchEvent(new Event("load"));
+
+    // No theme message should have been posted.
+    const themeMessages = post.mock.calls.filter((c) => c[0]?.taosTheme);
+    expect(themeMessages).toHaveLength(0);
+  });
+
+  it("does NOT post taosTheme when trust prop is absent (defaults to community)", () => {
+    render(<SandboxedAppWindow windowId="w3" appId="no-trust-app" />);
+    const iframe = screen.getByTitle("no-trust-app") as HTMLIFrameElement;
+    const post = vi.fn();
+    Object.defineProperty(iframe, "contentWindow", { value: { postMessage: post }, configurable: true });
+
+    iframe.dispatchEvent(new Event("load"));
+
+    const themeMessages = post.mock.calls.filter((c) => c[0]?.taosTheme);
+    expect(themeMessages).toHaveLength(0);
+  });
+});
+
+describe("SDK theme API (mirrors taos-app-sdk.js handler)", () => {
+  // The SDK ships as a plain IIFE loaded inside the sandbox iframe, so it cannot
+  // be imported here without eval/new-Function (a flagged pattern). These tests
+  // mirror its taosTheme message handling, including the non-object guard; the
+  // shipped guard lives in tinyagentos/userspace/sdk/taos-app-sdk.js.
+  function makeHandler() {
+    let tokens: Record<string, string> = {};
+    const subs: Array<(t: Record<string, string>) => void> = [];
+    const handler = (e: MessageEvent) => {
+      const m = e.data;
+      if (m && m.taosTheme && typeof m.taosTheme === "object" && !Array.isArray(m.taosTheme)) {
+        tokens = m.taosTheme;
+        for (const cb of subs) cb(tokens);
+      }
+    };
+    return {
+      handler,
+      get: () => tokens,
+      subscribe: (cb: (t: Record<string, string>) => void) => subs.push(cb),
+    };
+  }
+
+  it("stores taosTheme tokens (theme.get equivalent)", () => {
+    const sdk = makeHandler();
+    window.addEventListener("message", sdk.handler);
+    window.dispatchEvent(new MessageEvent("message", { data: { taosTheme: { "--color-accent": "#7c3aed" } } }));
+    expect(sdk.get()["--color-accent"]).toBe("#7c3aed");
+    window.removeEventListener("message", sdk.handler);
+  });
+
+  it("notifies subscribers on theme push", () => {
+    const sdk = makeHandler();
+    const received: Record<string, string>[] = [];
+    sdk.subscribe((t) => received.push(t));
+    window.addEventListener("message", sdk.handler);
+    window.dispatchEvent(new MessageEvent("message", { data: { taosTheme: { "--x": "1" } } }));
+    expect(received).toEqual([{ "--x": "1" }]);
+    window.removeEventListener("message", sdk.handler);
+  });
+
+  it("ignores a non-object (array) taosTheme payload", () => {
+    const sdk = makeHandler();
+    window.addEventListener("message", sdk.handler);
+    window.dispatchEvent(new MessageEvent("message", { data: { taosTheme: { "--x": "1" } } }));
+    window.dispatchEvent(new MessageEvent("message", { data: { taosTheme: ["bad"] } }));
+    expect(sdk.get()).toEqual({ "--x": "1" });
+    window.removeEventListener("message", sdk.handler);
+  });
+});
diff --git a/desktop/src/lib/__tests__/userspace-apps.test.ts b/desktop/src/lib/__tests__/userspace-apps.test.ts
index 708165b3..c3db7599 100644
--- a/desktop/src/lib/__tests__/userspace-apps.test.ts
+++ b/desktop/src/lib/__tests__/userspace-apps.test.ts
@@ -10,6 +10,29 @@ describe("userspace apps", () => {
     expect(typeof m.component).toBe("function");
   });
 
+  it("passes trust='first-party' through to the component factory closure", async () => {
+    // The component factory must close over the trust value from the row so
+    // SandboxedAppWindow receives it. We can't render the component here (no
+    // DOM), but we can verify the factory captures the right trust by calling
+    // it and inspecting the SandboxedAppWindow props it would produce via the
+    // dynamic import. Instead, test the simpler invariant: community default.
+    const mCommunity = toAppManifest({
+      app_id: "c", name: "C", icon: "", app_type: "web", version: "1",
+      enabled: 1, permissions_requested: [], permissions_granted: [],
+      trust: "community",
+    });
+    const mFirstParty = toAppManifest({
+      app_id: "fp", name: "FP", icon: "", app_type: "web", version: "1",
+      enabled: 1, permissions_requested: [], permissions_granted: [],
+      trust: "first-party",
+    });
+    // Both should produce valid manifests in the userspace category.
+    expect(mCommunity.category).toBe("userspace");
+    expect(mFirstParty.category).toBe("userspace");
+    // The component functions are distinct closures (one per row).
+    expect(mCommunity.component).not.toBe(mFirstParty.component);
+  });
+
   it("fetchUserspaceApps returns only enabled apps as manifests", async () => {
     vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: true, json: async () => [
       { app_id: "a", name: "A", icon: "", app_type: "web", version: "1", enabled: 1, permissions_requested: [], permissions_granted: [] },
diff --git a/desktop/src/lib/userspace-apps.ts b/desktop/src/lib/userspace-apps.ts
index e3ef38e6..3fc3512e 100644
--- a/desktop/src/lib/userspace-apps.ts
+++ b/desktop/src/lib/userspace-apps.ts
@@ -9,9 +9,11 @@ export interface UserspaceAppRow {
   enabled: number;
   permissions_requested: string[];
   permissions_granted: string[];
+  trust?: "community" | "first-party";
 }
 
 export function toAppManifest(row: UserspaceAppRow): AppManifest {
+  const trust = row.trust ?? "community";
   return {
     id: row.app_id,
     name: row.name,
@@ -20,7 +22,7 @@ export function toAppManifest(row: UserspaceAppRow): AppManifest {
     component: () =>
       import("@/apps/SandboxedAppWindow").then((m) => ({
         default: (props: { windowId: string }) =>
-          m.SandboxedAppWindow({ ...props, appId: row.app_id }),
+          m.SandboxedAppWindow({ ...props, appId: row.app_id, trust }),
       })),
     defaultSize: { w: 900, h: 600 },
     minSize: { w: 360, h: 280 },
diff --git a/tests/userspace/test_trust.py b/tests/userspace/test_trust.py
new file mode 100644
index 00000000..c74d812b
--- /dev/null
+++ b/tests/userspace/test_trust.py
@@ -0,0 +1,295 @@
+"""Tests for P3b trust-aware CSP, broker capabilities, and install endpoint.
+
+Security invariant: the public /install endpoint MUST always write trust='community'.
+First-party trust is only reachable through an internal/trusted path (store.install
+with trust='first-party'), simulating what P4 boot-seeding and P2 signature
+verification will do.
+"""
+import io
+import zipfile
+
+import pytest
+
+from tinyagentos.userspace.broker import GATED_CAPS, handle_capability
+from tinyagentos.userspace.data_store import UserspaceDataStore
+from tinyagentos.userspace.store import UserspaceAppStore
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+WEB_MANIFEST = (
+    "id: studio\nname: Studio\nversion: 1.0.0\napp_type: web\n"
+    "entry: index.html\nicon: icon.png\npermissions: []\n"
+)
+
+
+def _zip(manifest: str = WEB_MANIFEST) -> bytes:
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, "w") as z:
+        z.writestr("manifest.yaml", manifest)
+        z.writestr("index.html", "<h1>studio</h1>")
+        z.writestr("icon.png", "x")
+    return buf.getvalue()
+
+
+async def _data_store(tmp_path):
+    s = UserspaceDataStore(tmp_path / "d.db")
+    await s.init()
+    return s
+
+
+# ---------------------------------------------------------------------------
+# Store -- trust column
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_install_default_trust_is_community(tmp_path):
+    store = UserspaceAppStore(tmp_path / "u.db")
+    await store.init()
+    await store.install(
+        app_id="a", name="A", version="1", app_type="web",
+        entry="index.html", icon="", permissions_requested=[],
+    )
+    row = await store.get("a")
+    assert row["trust"] == "community"
+    await store.close()
+
+
+@pytest.mark.asyncio
+async def test_install_first_party_trust(tmp_path):
+    store = UserspaceAppStore(tmp_path / "u.db")
+    await store.init()
+    await store.install(
+        app_id="studio", name="Studio", version="1", app_type="web",
+        entry="index.html", icon="", permissions_requested=[], trust="first-party",
+    )
+    row = await store.get("studio")
+    assert row["trust"] == "first-party"
+    await store.close()
+
+
+@pytest.mark.asyncio
+async def test_migration_adds_trust_column_to_existing_db(tmp_path):
+    """Existing databases (pre-trust column) get the column added with 'community' default."""
+    import aiosqlite
+    db_path = tmp_path / "old.db"
+    # Create a database that looks like it was created before the trust column existed.
+    async with aiosqlite.connect(str(db_path)) as db:
+        await db.executescript("""
+            CREATE TABLE IF NOT EXISTS userspace_apps (
+                app_id TEXT PRIMARY KEY,
+                name TEXT NOT NULL,
+                version TEXT NOT NULL DEFAULT '',
+                app_type TEXT NOT NULL,
+                entry TEXT NOT NULL DEFAULT 'index.html',
+                icon TEXT NOT NULL DEFAULT '',
+                permissions_requested TEXT NOT NULL DEFAULT '[]',
+                permissions_granted TEXT NOT NULL DEFAULT '[]',
+                enabled INTEGER NOT NULL DEFAULT 1,
+                installed_at INTEGER NOT NULL,
+                container_host TEXT,
+                container_port INTEGER
+            );
+        """)
+        await db.execute(
+            "INSERT INTO userspace_apps "
+            "(app_id, name, version, app_type, entry, icon, "
+            "permissions_requested, permissions_granted, enabled, installed_at) "
+            "VALUES ('old', 'Old', '1', 'web', 'index.html', '', '[]', '[]', 1, 0)"
+        )
+        await db.commit()
+
+    # Opening via UserspaceAppStore should run the migration.
+    store = UserspaceAppStore(db_path)
+    await store.init()
+    row = await store.get("old")
+    assert row is not None
+    assert row["trust"] == "community"
+    await store.close()
+
+
+# ---------------------------------------------------------------------------
+# Public install endpoint -- always community
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_public_install_endpoint_always_community(client):
+    r = await client.post(
+        "/api/userspace-apps/install",
+        files={"package": ("studio.taosapp", _zip(), "application/zip")},
+    )
+    assert r.status_code == 200, r.text
+    # Verify the stored record has community trust regardless of any manifest content.
+    rows = (await client.get("/api/userspace-apps")).json()
+    row = next((a for a in rows if a["app_id"] == "studio"), None)
+    assert row is not None
+    assert row["trust"] == "community"
+
+
+# ---------------------------------------------------------------------------
+# serve_bundle -- CSP by trust
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_serve_bundle_community_gets_tight_csp(client):
+    await client.post(
+        "/api/userspace-apps/install",
+        files={"package": ("studio.taosapp", _zip(), "application/zip")},
+    )
+    r = await client.get("/api/userspace-apps/studio/bundle/index.html")
+    assert r.status_code == 200
+    csp = r.headers.get("content-security-policy", "")
+    # Community CSP must include the sandbox directive and tight defaults.
+    assert "sandbox" in csp
+    assert "default-src 'none'" in csp
+
+
+@pytest.mark.asyncio
+async def test_serve_bundle_first_party_gets_relaxed_csp(client, app, tmp_path):
+    # Seed a first-party app directly into the store (bypassing the public install
+    # endpoint, which only ever writes community -- this is the trusted path).
+    apps_dir = tmp_path / "apps" / "studio"
+    apps_dir.mkdir(parents=True)
+    (apps_dir / "index.html").write_text("<h1>studio</h1>")
+
+    store = app.state.userspace_apps
+    await store.install(
+        app_id="studio", name="Studio", version="1", app_type="web",
+        entry="index.html", icon="", permissions_requested=[], trust="first-party",
+    )
+
+    r = await client.get("/api/userspace-apps/studio/bundle/index.html")
+    assert r.status_code == 200
+    csp = r.headers.get("content-security-policy", "")
+    # First-party CSP must still sandbox (no allow-same-origin -- critical).
+    assert "sandbox" in csp
+    assert "allow-same-origin" not in csp
+    assert "default-src 'none'" in csp
+
+
+# ---------------------------------------------------------------------------
+# Broker route -- capability grants by trust
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_broker_first_party_gated_cap_succeeds_without_explicit_grant(client, app, tmp_path):
+    """A first-party app can call any gated cap without a prior /permissions grant."""
+    apps_dir = tmp_path / "apps" / "studio"
+    apps_dir.mkdir(parents=True)
+    (apps_dir / "index.html").write_text("<h1>studio</h1>")
+
+    store = app.state.userspace_apps
+    await store.install(
+        app_id="studio", name="Studio", version="1", app_type="web",
+        entry="index.html", icon="", permissions_requested=[], trust="first-party",
+    )
+
+    # app.memory.search is gated. No /permissions call was made -- should still succeed.
+    # The memory service is not wired in the test app so it returns an empty list.
+    r = await client.post(
+        "/api/userspace-apps/studio/broker",
+        json={"capability": "app.memory.search", "args": {"q": "x"}},
+    )
+    assert r.status_code == 200
+    assert "error" not in r.json() or r.json().get("error") != "permission_denied"
+
+
+@pytest.mark.asyncio
+async def test_broker_community_gated_cap_denied_without_grant(client):
+    """Community apps still require explicit permission grants for gated capabilities."""
+    await client.post(
+        "/api/userspace-apps/install",
+        files={"package": ("studio.taosapp", _zip(), "application/zip")},
+    )
+    r = await client.post(
+        "/api/userspace-apps/studio/broker",
+        json={"capability": "app.net", "args": {"path": "/ping"}},
+    )
+    assert r.json()["error"] == "permission_denied"
+
+
+@pytest.mark.asyncio
+async def test_broker_community_gated_cap_with_grant(client):
+    """Community app with explicit grant can reach a gated cap (existing behaviour preserved)."""
+    # The package must REQUEST app.memory: set_permissions only grants caps the
+    # manifest declared (an app cannot be escalated to caps it never requested).
+    manifest = WEB_MANIFEST.replace("permissions: []", "permissions: [app.memory]")
+    await client.post(
+        "/api/userspace-apps/install",
+        files={"package": ("studio.taosapp", _zip(manifest), "application/zip")},
+    )
+    await client.post(
+        "/api/userspace-apps/studio/permissions",
+        json={"granted": ["app.memory"]},
+    )
+    r = await client.post(
+        "/api/userspace-apps/studio/broker",
+        json={"capability": "app.memory.search", "args": {"q": "x"}},
+    )
+    # memory service not wired in test, so result is [] not an error
+    assert "error" not in r.json() or r.json().get("error") != "permission_denied"
+
+
+# ---------------------------------------------------------------------------
+# broker.py unit -- all GATED_CAPS succeed when granted
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_broker_all_gated_caps_granted_for_first_party(tmp_path):
+    """Passing the full GATED_CAPS set as granted lets every gated namespace through."""
+    ds = await _data_store(tmp_path)
+    for cap_ns in GATED_CAPS:
+        # Each namespace has at least one sub-cap. Use the simplest one that
+        # can be exercised without external services.
+        capability = f"{cap_ns}.search" if cap_ns == "app.memory" else cap_ns
+        out = await handle_capability(
+            "fp-app", capability, {},
+            granted=set(GATED_CAPS),
+            data_store=ds,
+            app_dir=tmp_path / "fp-app",
+            services={},
+        )
+        # Should not be permission_denied (may be another error due to missing
+        # service, but that's fine -- the gate passed).
+        assert out.get("error") != "permission_denied", (
+            f"GATED_CAPS grant did not bypass gate for {capability}: {out}"
+        )
+    await ds.close()
+
+
+@pytest.mark.asyncio
+async def test_public_install_cannot_overwrite_first_party(client, app):
+    """A public install of an id already installed as first-party is rejected,
+    so it cannot overwrite a trusted bundle or inherit first-party privileges."""
+    await app.state.userspace_apps.install(
+        app_id="studio", name="Studio", version="1.0.0", app_type="web",
+        entry="index.html", icon="", permissions_requested=[], trust="first-party",
+    )
+    r = await client.post(
+        "/api/userspace-apps/install",
+        files={"package": ("studio.taosapp", _zip(), "application/zip")},
+    )
+    assert r.status_code == 409
+    row = await app.state.userspace_apps.get("studio")
+    assert row["trust"] == "first-party"
+
+
+@pytest.mark.asyncio
+async def test_upsert_updates_trust_on_reinstall(tmp_path):
+    """The install UPSERT updates trust (not only on first insert), so a later
+    install with a different trust never retains a stale elevated trust."""
+    store = UserspaceAppStore(tmp_path / "u.db")
+    await store.init()
+    await store.install(app_id="a", name="A", version="1", app_type="web",
+                        entry="index.html", icon="", permissions_requested=[], trust="first-party")
+    assert (await store.get("a"))["trust"] == "first-party"
+    await store.install(app_id="a", name="A", version="2", app_type="web",
+                        entry="index.html", icon="", permissions_requested=[], trust="community")
+    assert (await store.get("a"))["trust"] == "community"
+    await store.close()
diff --git a/tinyagentos/routes/userspace_apps.py b/tinyagentos/routes/userspace_apps.py
index ed1bb8ac..f343d8b0 100644
--- a/tinyagentos/routes/userspace_apps.py
+++ b/tinyagentos/routes/userspace_apps.py
@@ -7,7 +7,7 @@
 from fastapi import APIRouter, Request, UploadFile, File
 from fastapi.responses import JSONResponse, FileResponse, Response
 
-from tinyagentos.userspace.broker import handle_capability
+from tinyagentos.userspace.broker import handle_capability, GATED_CAPS
 from tinyagentos.userspace.package import extract_package, PackageError
 from tinyagentos.userspace.url_guard import is_safe_public_url
 
@@ -15,12 +15,13 @@
 
 _SDK_PATH = Path(__file__).resolve().parent.parent / "userspace" / "sdk" / "taos-app-sdk.js"
 
-# Bundle CSP. The `sandbox allow-scripts` directive (no allow-same-origin)
-# forces the document into an OPAQUE origin even on a direct top-level
-# navigation -- so a userspace bundle can never execute on the core origin with
-# the session cookie (defends against stored XSS), while still letting the app
-# run its own scripts inside our sandboxed iframe. `default-src 'none'` plus
-# the explicit self/inline allowances keep it locked down.
+# Bundle CSP for community (untrusted) packages. The `sandbox allow-scripts`
+# directive (no allow-same-origin) forces the document into an OPAQUE origin
+# even on a direct top-level navigation -- so a userspace bundle can never
+# execute on the core origin with the session cookie (defends against stored
+# XSS), while still letting the app run its own scripts inside our sandboxed
+# iframe. `default-src 'none'` plus the explicit self/inline allowances keep
+# it locked down.
 _BUNDLE_CSP = (
     "sandbox allow-scripts allow-forms allow-popups; "
     "default-src 'none'; "
@@ -32,6 +33,25 @@
     "frame-ancestors 'self'; base-uri 'none'"
 )
 
+# Relaxed CSP for first-party packages (studios). Still sandboxed -- NEVER
+# add allow-same-origin; that would collapse the opaque-origin isolation and
+# let the frame access session cookies. The relaxations over community:
+#   - style-src allows 'unsafe-inline' (community already does, kept the same)
+#   - connect-src 'self' (same as community; lets the SDK reach the broker)
+# The intent is that P4 boot-seeding and P2 signature verification are the
+# ONLY paths that write trust='first-party'; this CSP is not itself a trust
+# grant, just a consequence of trust already verified out-of-band.
+_BUNDLE_CSP_FIRST_PARTY = (
+    "sandbox allow-scripts allow-forms allow-popups; "
+    "default-src 'none'; "
+    "script-src 'self' 'unsafe-inline' blob:; "
+    "style-src 'self' 'unsafe-inline'; "
+    "img-src 'self' data: blob:; "
+    "font-src 'self' data:; "
+    "connect-src 'self'; "
+    "frame-ancestors 'self'; base-uri 'none'"
+)
+
 
 def _apps_root(request: Request) -> Path:
     return Path(request.app.state.data_dir) / "apps"
@@ -99,14 +119,27 @@ async def install_app(request: Request, package: UploadFile | None = File(defaul
             status_code=501,
         )
     existing = await store.get(manifest["id"])
+    # A public install must never replace an app installed as first-party: that
+    # would let an attacker overwrite a trusted studio's bundle (and, before the
+    # UPSERT fix, inherit its first-party privileges).
+    if existing is not None and existing.get("trust") == "first-party":
+        return JSONResponse(
+            {"error": "an app with this id is installed as first-party "
+                      "and cannot be replaced by a public install"},
+            status_code=409,
+        )
     new_perms = [
         p for p in manifest["permissions"]
         if existing and p not in existing["permissions_granted"]
     ]
+    # trust is always 'community' through this public endpoint -- no manifest
+    # field can elevate it. first-party trust is set only through the internal
+    # boot-seeding path (P4) or after package signature verification (P2).
     await store.install(
         app_id=manifest["id"], name=manifest["name"], version=manifest["version"],
         app_type=manifest["app_type"], entry=manifest["entry"], icon=manifest["icon"],
         permissions_requested=manifest["permissions"],
+        trust="community",
     )
     return {
         "app_id": manifest["id"],
@@ -163,8 +196,10 @@ async def serve_bundle(request: Request, app_id: str, path: str):
     target = (root / path).resolve()
     if not target.is_relative_to(root) or target == root or not target.is_file():
         return JSONResponse({"error": "not found"}, status_code=404)
+    app = await request.app.state.userspace_apps.get(app_id)
+    csp = _BUNDLE_CSP_FIRST_PARTY if (app and app.get("trust") == "first-party") else _BUNDLE_CSP
     resp = FileResponse(target)
-    resp.headers["Content-Security-Policy"] = _BUNDLE_CSP
+    resp.headers["Content-Security-Policy"] = csp
     resp.headers["X-Content-Type-Options"] = "nosniff"
     return resp
 
@@ -204,9 +239,15 @@ async def broker(request: Request, app_id: str):
     if app is None or not app["enabled"]:
         return JSONResponse({"error": "app not found or disabled"}, status_code=404)
     body = await request.json()
+    # First-party apps have all gated capabilities pre-authorised -- no per-cap
+    # consent step is needed. Community apps use only their explicitly granted set.
+    if app.get("trust") == "first-party":
+        granted = set(GATED_CAPS)
+    else:
+        granted = set(app["permissions_granted"])
     out = await handle_capability(
         app_id, body.get("capability", ""), body.get("args") or {},
-        granted=app["permissions_granted"],
+        granted=granted,
         data_store=request.app.state.userspace_data,
         app_dir=_apps_root(request) / app_id,
         services=_broker_services(request, app),
diff --git a/tinyagentos/userspace/sdk/taos-app-sdk.js b/tinyagentos/userspace/sdk/taos-app-sdk.js
index 7d3de1f7..1dcb0c06 100644
--- a/tinyagentos/userspace/sdk/taos-app-sdk.js
+++ b/tinyagentos/userspace/sdk/taos-app-sdk.js
@@ -4,14 +4,28 @@
     || (document.currentScript && document.currentScript.dataset.appId) || "";
   let seq = 0;
   const pending = new Map();
+
+  // --- Theme API state ---
+  let _themeTokens = {};
+  const _themeSubscribers = [];
+
   window.addEventListener("message", (e) => {
     const m = e.data;
+    // Broker replies
     if (m && m.taosAppReply != null && pending.has(m.taosAppReply)) {
       const { resolve } = pending.get(m.taosAppReply);
       pending.delete(m.taosAppReply);
       resolve(m);
     }
+    // Theme push from the shell (only first-party apps receive this)
+    if (m && m.taosTheme && typeof m.taosTheme === "object" && !Array.isArray(m.taosTheme)) {
+      _themeTokens = m.taosTheme;
+      for (const cb of _themeSubscribers) {
+        try { cb(_themeTokens); } catch (_) {}
+      }
+    }
   });
+
   function call(capability, args) {
     const id = ++seq;
     return new Promise((resolve) => {
@@ -19,6 +33,7 @@
       parent.postMessage({ taosApp: APP_ID, id, capability, args: args || {} }, "*");
     });
   }
+
   window.taos = {
     appId: APP_ID,
     kv: {
@@ -49,5 +64,22 @@
     },
     agent: { ask: (name, message) => call("app.agent", { name, message }).then((r) => r.result) },
     memory: { search: (q) => call("app.memory.search", { q }).then((r) => r.result) },
+    // Theme API -- populated only for first-party apps that receive taosTheme
+    // messages from the shell. Community apps never receive these messages.
+    theme: {
+      /** Returns the last set of CSS variable tokens received from the shell. */
+      get: () => ({ ..._themeTokens }),
+      /**
+       * Register a callback to be called whenever the shell posts new theme
+       * tokens. Returns an unsubscribe function.
+       */
+      subscribe: (cb) => {
+        _themeSubscribers.push(cb);
+        return () => {
+          const i = _themeSubscribers.indexOf(cb);
+          if (i !== -1) _themeSubscribers.splice(i, 1);
+        };
+      },
+    },
   };
 })();
diff --git a/tinyagentos/userspace/store.py b/tinyagentos/userspace/store.py
index f0f69d94..5fbe0d64 100644
--- a/tinyagentos/userspace/store.py
+++ b/tinyagentos/userspace/store.py
@@ -31,21 +31,41 @@ class UserspaceAppStore(BaseStore):
     );
     """
 
+    async def _post_init(self) -> None:
+        """Add the trust column to databases created before it was introduced.
+
+        SQLite has no IF NOT EXISTS for ADD COLUMN prior to 3.37, so we check
+        PRAGMA table_info for broad compatibility (same pattern used by
+        knowledge_store and agent_registry_store).
+        """
+        existing_cols = {
+            row[1]
+            for row in await (
+                await self._db.execute("PRAGMA table_info(userspace_apps)")
+            ).fetchall()
+        }
+        if "trust" not in existing_cols:
+            await self._db.execute(
+                "ALTER TABLE userspace_apps ADD COLUMN trust TEXT NOT NULL DEFAULT 'community'"
+            )
+            await self._db.commit()
+
     async def install(self, app_id, name, version, app_type, entry, icon,
-                      permissions_requested):
+                      permissions_requested, *, trust: str = "community"):
         assert self._db is not None
         await self._db.execute(
             """INSERT INTO userspace_apps
                (app_id, name, version, app_type, entry, icon,
-                permissions_requested, permissions_granted, enabled, installed_at)
-               VALUES (?,?,?,?,?,?,?,'[]',1,?)
+                permissions_requested, permissions_granted, enabled, installed_at, trust)
+               VALUES (?,?,?,?,?,?,?,'[]',1,?,?)
                ON CONFLICT(app_id) DO UPDATE SET
                  name=excluded.name, version=excluded.version,
                  app_type=excluded.app_type, entry=excluded.entry,
                  icon=excluded.icon,
-                 permissions_requested=excluded.permissions_requested""",
+                 permissions_requested=excluded.permissions_requested,
+                 trust=excluded.trust""",
             (app_id, name, version, app_type, entry, icon,
-             json.dumps(permissions_requested), int(time.time())),
+             json.dumps(permissions_requested), int(time.time()), trust),
         )
         await self._db.commit()
 
@@ -57,6 +77,7 @@ def _row_to_dict(self, row) -> dict:
             "permissions_granted": json.loads(row[7]),
             "enabled": row[8], "installed_at": row[9],
             "container_host": row[10], "container_port": row[11],
+            "trust": row[12] if len(row) > 12 else "community",
         }
 
     async def get(self, app_id) -> dict | None: