# OpenShell policy

**Status:** Base policy and overlays ready for S5.

## Structure

| Path | Purpose |
|------|---------|
| `base.yaml` | Deny-by-default intent (reference; not applied directly) |
| `overlays/inference.yaml` | Inference endpoint (applied at S5) |
| `overlays/square-mcp.yaml` | Square MCP (applied at S7 when connected) |
| `overlays/quickbooks.yaml` | QuickBooks Online (applied at S7 when connected) |
| `overlays/vagaro.yaml` | Vagaro REST API (applied at S7 when connected) |
| `overlays/channels.yaml` | Messaging channels (applied at S7 when connected) |

## Policy lifecycle

1. **Install (S5):** Apply inference overlay. Existing balanced-tier presets (npm, pypi, huggingface, brew) are preserved.
2. **Connect (S7):** Apply SaaS/channel overlays as integrations are enabled.
3. **Upgrade:** Re-apply all overlays (idempotent via `--yes`).
4. **Doctor (S6):** Verify active policy matches expected state.

## Apply policy

```bash
# Apply inference overlay (S5)
nemohermes <name> policy-add --from-file policy/openshell/overlays/inference.yaml --yes

# Apply SaaS overlay (S7, when connected)
nemohermes <name> policy-add --from-file policy/openshell/overlays/square-mcp.yaml --yes

# Apply built-in channel preset (S7, when connected)
nemohermes <name> policy-add telegram --yes

# List active presets
nemohermes <name> policy-list

# Export current policy
nemohermes <name> policy-get
```

## Key principles

- **Additive only:** policy-add never removes existing presets.
- **No wipe:** Never remove balanced-tier presets (npm, pypi, huggingface, brew).
- **Always deny:** Social publish, payment/refund/payout/bill-pay are never allowed.
- **Platform-first:** All policy mutations via `nemohermes` / `openshell` CLIs.

## Design reference

- [design/DESIGN_PLAN.md §3](../../design/DESIGN_PLAN.md) — Hermes as NemoClaw-managed infrastructure
- [docs/POLICY.md](../../docs/POLICY.md) — Full policy documentation