Ty
0198ab6881
Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.
34 lines
1.7 KiB
YAML
34 lines
1.7 KiB
YAML
# policy/openshell/base.yaml
|
|
# Lumina base policy — reference document.
|
|
#
|
|
# This file documents the deny-by-default intent for the Lumina sandbox.
|
|
# It is NOT applied directly. The live policy is managed by nemohermes
|
|
# policy-add/policy-remove commands.
|
|
#
|
|
# Apply via: nemohermes <name> policy-add --from-file <path>
|
|
#
|
|
# ── Deny-by-default intent ────────────────────────────────────────────────
|
|
#
|
|
# The sandbox starts with NO network egress except what is explicitly allowed
|
|
# by applied policy presets. The base tier (balanced) provides:
|
|
#
|
|
# npm, pypi, huggingface, brew — package management (always allowed)
|
|
#
|
|
# Lumina adds overlays for:
|
|
# - inference endpoints (main model + vision)
|
|
# - SaaS integrations (Square, QBO, Vagaro) — when connected
|
|
# - messaging channels (WhatsApp, Telegram, Email) — when connected
|
|
#
|
|
# ── Always deny ────────────────────────────────────────────────────────────
|
|
# - Social publish APIs (no silent publish)
|
|
# - Payment/refund/payout/bill-pay endpoints
|
|
# - Any host not explicitly listed in an overlay
|
|
#
|
|
# ── Policy lifecycle ───────────────────────────────────────────────────────
|
|
# 1. Install (S5): apply base overlays (inference)
|
|
# 2. Connect (S7): apply SaaS/channel overlays as integrations are enabled
|
|
# 3. Upgrade: re-apply all overlays (idempotent)
|
|
# 4. Doctor (S6): verify active policy matches expected state
|
|
#
|
|
# See docs/POLICY.md for full policy documentation.
|