Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.
2026-07-27 12:13:25 -07:00
parent e5e179e541
commit 0198ab6881
38 changed files with 1422 additions and 51 deletions
@@ -1,14 +1,52 @@
-# OpenShell policy (scaffold)
+# OpenShell policy

-**Status:** Structure only — no live policy applied until **build**.
+**Status:** Base policy and overlays ready for S5.

-## Intended contents
+## Structure

 | Path | Purpose |
 |------|---------|
-| `policy.yaml` (or equivalent) | Deny-by-default base for salon egress |
-| `overlays/` | Per-integration allowlists (Square MCP host, QBO local, channels, etc.) |
+| `base.yaml` | Deny-by-default intent (reference; not applied directly) |
+| `overlays/inference.yaml` | Inference endpoint (applied at S5) |
+| `overlays/square-mcp.yaml` | Square MCP (applied at S7 when connected) |
+| `overlays/quickbooks.yaml` | QuickBooks Online (applied at S7 when connected) |
+| `overlays/vagaro.yaml` | Vagaro REST API (applied at S7 when connected) |
+| `overlays/channels.yaml` | Messaging channels (applied at S7 when connected) |

-Apply via platform CLIs only: `openshell policy set`, `nemohermes <name> policy-add` / `policy-remove`.
+## Policy lifecycle

-See [design/mcp-integrations.md](../../design/mcp-integrations.md) and [docs/POLICY.md](../../docs/POLICY.md).
+1. **Install (S5):** Apply inference overlay. Existing balanced-tier presets (npm, pypi, huggingface, brew) are preserved.
+2. **Connect (S7):** Apply SaaS/channel overlays as integrations are enabled.
+3. **Upgrade:** Re-apply all overlays (idempotent via `--yes`).
+4. **Doctor (S6):** Verify active policy matches expected state.
+
+## Apply policy
+
+```bash
+# Apply inference overlay (S5)
+nemohermes <name> policy-add --from-file policy/openshell/overlays/inference.yaml --yes
+
+# Apply SaaS overlay (S7, when connected)
+nemohermes <name> policy-add --from-file policy/openshell/overlays/square-mcp.yaml --yes
+
+# Apply built-in channel preset (S7, when connected)
+nemohermes <name> policy-add telegram --yes
+
+# List active presets
+nemohermes <name> policy-list
+
+# Export current policy
+nemohermes <name> policy-get
+```
+
+## Key principles
+
+- **Additive only:** policy-add never removes existing presets.
+- **No wipe:** Never remove balanced-tier presets (npm, pypi, huggingface, brew).
+- **Always deny:** Social publish, payment/refund/payout/bill-pay are never allowed.
+- **Platform-first:** All policy mutations via `nemohermes` / `openshell` CLIs.
+
+## Design reference
+
+- [design/DESIGN_PLAN.md §3](../../design/DESIGN_PLAN.md) — Hermes as NemoClaw-managed infrastructure
+- [docs/POLICY.md](../../docs/POLICY.md) — Full policy documentation