Ty
0198ab6881
Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.
53 lines
1.9 KiB
Markdown
53 lines
1.9 KiB
Markdown
# OpenShell policy
|
|
|
|
**Status:** Base policy and overlays ready for S5.
|
|
|
|
## Structure
|
|
|
|
| Path | Purpose |
|
|
|------|---------|
|
|
| `base.yaml` | Deny-by-default intent (reference; not applied directly) |
|
|
| `overlays/inference.yaml` | Inference endpoint (applied at S5) |
|
|
| `overlays/square-mcp.yaml` | Square MCP (applied at S7 when connected) |
|
|
| `overlays/quickbooks.yaml` | QuickBooks Online (applied at S7 when connected) |
|
|
| `overlays/vagaro.yaml` | Vagaro REST API (applied at S7 when connected) |
|
|
| `overlays/channels.yaml` | Messaging channels (applied at S7 when connected) |
|
|
|
|
## Policy lifecycle
|
|
|
|
1. **Install (S5):** Apply inference overlay. Existing balanced-tier presets (npm, pypi, huggingface, brew) are preserved.
|
|
2. **Connect (S7):** Apply SaaS/channel overlays as integrations are enabled.
|
|
3. **Upgrade:** Re-apply all overlays (idempotent via `--yes`).
|
|
4. **Doctor (S6):** Verify active policy matches expected state.
|
|
|
|
## Apply policy
|
|
|
|
```bash
|
|
# Apply inference overlay (S5)
|
|
nemohermes <name> policy-add --from-file policy/openshell/overlays/inference.yaml --yes
|
|
|
|
# Apply SaaS overlay (S7, when connected)
|
|
nemohermes <name> policy-add --from-file policy/openshell/overlays/square-mcp.yaml --yes
|
|
|
|
# Apply built-in channel preset (S7, when connected)
|
|
nemohermes <name> policy-add telegram --yes
|
|
|
|
# List active presets
|
|
nemohermes <name> policy-list
|
|
|
|
# Export current policy
|
|
nemohermes <name> policy-get
|
|
```
|
|
|
|
## Key principles
|
|
|
|
- **Additive only:** policy-add never removes existing presets.
|
|
- **No wipe:** Never remove balanced-tier presets (npm, pypi, huggingface, brew).
|
|
- **Always deny:** Social publish, payment/refund/payout/bill-pay are never allowed.
|
|
- **Platform-first:** All policy mutations via `nemohermes` / `openshell` CLIs.
|
|
|
|
## Design reference
|
|
|
|
- [design/DESIGN_PLAN.md §3](../../design/DESIGN_PLAN.md) — Hermes as NemoClaw-managed infrastructure
|
|
- [docs/POLICY.md](../../docs/POLICY.md) — Full policy documentation
|