# policy/openshell/overlays/inference.yaml
# Inference endpoint policy overlay for Lumina.
#
# Allows the sandbox to reach the configured inference endpoint through
# the OpenShell gateway. The gateway resolves inference.local to the
# actual endpoint URL from .env.
#
# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
#
# This overlay is additive — it does not remove existing presets.

preset:
  name: lumina-inference
network_policies:
  lumina-inference:
    name: lumina-inference
    endpoints:
      - host: inference.local
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: POST
              path: /v1/chat/completions
          - allow:
              method: POST
              path: /v1/messages
          - allow:
              method: POST
              path: /v1/responses
          - allow:
              method: POST
              path: /v1/completions
          - allow:
              method: POST
              path: /v1/embeddings
          - allow:
              method: GET
              path: /v1/models
          - allow:
              method: GET
              path: /v1/models/**
    binaries:
      - path: /usr/local/bin/hermes
      # Glob supported by nemohermes policy engine (verified against built-in
      # presets: huggingface, nous_research, npm_yarn, pypi all use python3*)
      - path: /usr/bin/python3*
      - path: /opt/hermes/.venv/bin/python