Salon_Assistant/policy/openshell

OpenShell policy

Status: Base policy and overlays ready for S5.

Structure

Path	Purpose
base.yaml	Deny-by-default intent (reference; not applied directly)
overlays/inference.yaml	Inference endpoint (applied at S5)
overlays/square-mcp.yaml	Square MCP (applied at S7 when connected)
overlays/quickbooks.yaml	QuickBooks Online (applied at S7 when connected)
overlays/vagaro.yaml	Vagaro REST API (applied at S7 when connected)
overlays/channels.yaml	Messaging channels (applied at S7 when connected)

Policy lifecycle

1. Install (S5): Apply inference overlay. Existing balanced-tier presets (npm, pypi, huggingface, brew) are preserved.
2. Connect (S7): Apply SaaS/channel overlays as integrations are enabled.
3. Upgrade: Re-apply all overlays (idempotent via --yes).
4. Doctor (S6): Verify active policy matches expected state.

Apply policy

# Apply inference overlay (S5)
nemohermes <name> policy-add --from-file policy/openshell/overlays/inference.yaml --yes

# Apply SaaS overlay (S7, when connected)
nemohermes <name> policy-add --from-file policy/openshell/overlays/square-mcp.yaml --yes

# Apply built-in channel preset (S7, when connected)
nemohermes <name> policy-add telegram --yes

# List active presets
nemohermes <name> policy-list

# Export current policy
nemohermes <name> policy-get

Key principles

• Additive only: policy-add never removes existing presets.
• No wipe: Never remove balanced-tier presets (npm, pypi, huggingface, brew).
• Always deny: Social publish, payment/refund/payout/bill-pay are never allowed.
• Platform-first: All policy mutations via nemohermes / openshell CLIs.

Design reference

• design/DESIGN_PLAN.md §3 — Hermes as NemoClaw-managed infrastructure
• docs/POLICY.md — Full policy documentation