217 lines
6.5 KiB
YAML
217 lines
6.5 KiB
YAML
|
# Default envelope for an L0 coding agent on an explicit human task
|
||
|
|
# in a HOT build-mode estate (canon A6).
|
||
|
|
#
|
||
|
|
# Semantics
|
||
|
|
# - mode: autonomous | autonomous_with_obligations | escalate | deny | root_authorization_required
|
||
|
|
# - variants: evaluated top to bottom against request attributes; first match replaces
|
||
|
|
# the row's mode (and obligations / evidence_required / rules when given).
|
||
|
|
# - deny and root_authorization_required rows are constitutional: they apply in EVERY
|
||
|
|
# scope (any temperature, any tenant) and no registry delegation overrides them.
|
||
|
|
# - All other rows apply only where `applies_when` matches. Elsewhere only explicit
|
||
|
|
# delegations (registry, platform tenant envelope) grant anything.
|
||
|
|
# - escalate means "not delegated here": the decision goes to the delegator with
|
||
|
|
# blocking_condition no_delegation, unless a registry delegation covers the class.
|
||
|
|
apiVersion: emergent-security/v0.8
|
||
|
|
kind: DefaultEnvelope
|
||
|
|
id: envelope://default/build-hot/L0
|
||
|
|
canon: "0.8"
|
||
|
|
delegator: task_assigner # the human who assigned the task, within their own authority
|
||
|
|
applies_when:
|
||
|
|
level: L0
|
||
|
|
temperature: hot
|
||
|
|
phase: build
|
||
|
|
tenant: none
|
||
|
|
risk_envelope:
|
||
|
|
blast_radius: repository
|
||
|
|
tenant_reach: none
|
||
|
|
data_sensitivity: internal
|
||
|
|
irreversible: false
|
||
|
|
external_exposure: none
|
||
|
|
|
||
|
|
classes:
|
||
|
|
# --- code and tests -------------------------------------------------------
|
||
|
|
- id: code.edit
|
||
|
|
title: Edit code inside task scope
|
||
|
|
mode: autonomous
|
||
|
|
rules: [C4]
|
||
|
|
|
||
|
|
- id: test.add
|
||
|
|
title: Add or strengthen tests
|
||
|
|
mode: autonomous
|
||
|
|
rules: [C8]
|
||
|
|
|
||
|
|
- id: test.weaken
|
||
|
|
title: Delete, skip or weaken tests or assertions
|
||
|
|
mode: escalate
|
||
|
|
rules: [C3, C8]
|
||
|
|
variants:
|
||
|
|
- when: { stated_task: true }
|
||
|
|
mode: autonomous
|
||
|
|
|
||
|
|
# --- dependencies and external code ----------------------------------------
|
||
|
|
- id: dependency.add
|
||
|
|
title: Add or update a dependency
|
||
|
|
mode: escalate
|
||
|
|
rules: [C9]
|
||
|
|
variants:
|
||
|
|
- when: { source: standard_registry, pinned: true }
|
||
|
|
mode: autonomous_with_obligations
|
||
|
|
rules: [C6]
|
||
|
|
evidence_required: [lockfile_updated]
|
||
|
|
obligations: [record]
|
||
|
|
|
||
|
|
- id: code.fetch_execute
|
||
|
|
title: Run code fetched at runtime (curl | sh, unpinned remote scripts, unknown binaries)
|
||
|
|
mode: escalate
|
||
|
|
rules: [C9]
|
||
|
|
|
||
|
|
- id: data.egress
|
||
|
|
title: Send repository content, data or credentials to an external service not named in the task
|
||
|
|
mode: escalate
|
||
|
|
rules: [C5]
|
||
|
|
|
||
|
|
# --- git -----------------------------------------------------------------
|
||
|
|
- id: git.commit_feature
|
||
|
|
title: Commit to a feature branch
|
||
|
|
mode: autonomous
|
||
|
|
rules: []
|
||
|
|
|
||
|
|
- id: git.push_feature
|
||
|
|
title: Push a feature branch
|
||
|
|
mode: autonomous
|
||
|
|
rules: []
|
||
|
|
|
||
|
|
- id: git.merge_protected
|
||
|
|
title: Merge into a protected or default branch
|
||
|
|
mode: escalate
|
||
|
|
rules: [C4]
|
||
|
|
|
||
|
|
- id: git.history_rewrite
|
||
|
|
title: Force-push or rewrite shared history
|
||
|
|
mode: escalate
|
||
|
|
rules: [C11]
|
||
|
|
variants:
|
||
|
|
- when: { branch_protected: true }
|
||
|
|
mode: deny
|
||
|
|
|
||
|
|
# --- CI, checks, policy ----------------------------------------------------
|
||
|
|
- id: ci.add_check
|
||
|
|
title: Add CI checks, hooks, linters
|
||
|
|
mode: autonomous
|
||
|
|
rules: [C8]
|
||
|
|
|
||
|
|
- id: ci.weaken
|
||
|
|
title: Modify CI so that checks are weaker, skipped or conditional
|
||
|
|
mode: escalate
|
||
|
|
rules: [C3, C9]
|
||
|
|
|
||
|
|
- id: checks.bypass
|
||
|
|
title: Bypass hooks or checks (--no-verify, skip flags, || true on checks)
|
||
|
|
mode: deny
|
||
|
|
rules: [C3, C9]
|
||
|
|
|
||
|
|
- id: policy.edit
|
||
|
|
title: Edit own permission config, agent instructions governing itself, CODEOWNERS, branch protection, delegation registry, policy or discovery files
|
||
|
|
mode: deny # direction: widen, or unknown
|
||
|
|
rules: [C3]
|
||
|
|
variants:
|
||
|
|
- when: { direction: narrow }
|
||
|
|
mode: autonomous
|
||
|
|
- when: { direction: propose }
|
||
|
|
mode: autonomous_with_obligations
|
||
|
|
obligations: [human_review, no_self_merge]
|
||
|
|
|
||
|
|
# --- secrets and credentials ------------------------------------------------
|
||
|
|
- id: secrets.read
|
||
|
|
title: Read secrets through a broker for the task
|
||
|
|
mode: escalate
|
||
|
|
rules: [C6]
|
||
|
|
variants:
|
||
|
|
- when: { via_broker: true }
|
||
|
|
mode: autonomous_with_obligations
|
||
|
|
obligations: [shortest_ttl, record]
|
||
|
|
|
||
|
|
- id: secrets.write
|
||
|
|
title: Write secrets to code, config, logs, prompts, memory or commits
|
||
|
|
mode: deny
|
||
|
|
rules: [C2, C6]
|
||
|
|
|
||
|
|
- id: credential.reuse_broader
|
||
|
|
title: Reuse a broader credential that happens to be available
|
||
|
|
mode: deny
|
||
|
|
rules: [C2, C7]
|
||
|
|
|
||
|
|
# --- environments, agents, deployment ---------------------------------------
|
||
|
|
- id: env.disposable
|
||
|
|
title: Create or destroy disposable environments, sandboxes, runners
|
||
|
|
mode: escalate
|
||
|
|
rules: []
|
||
|
|
variants:
|
||
|
|
- when: { owned_by_self: true }
|
||
|
|
mode: autonomous
|
||
|
|
|
||
|
|
- id: agent.delegate
|
||
|
|
title: Hand work to a subagent or another agent
|
||
|
|
mode: deny # wider than own envelope, or unknown
|
||
|
|
rules: [C3, C6]
|
||
|
|
variants:
|
||
|
|
- when: { within_own_envelope: true, same_task_scope: true }
|
||
|
|
mode: autonomous
|
||
|
|
|
||
|
|
- id: deploy.internal
|
||
|
|
title: Deploy to an internal, reversible, non-tenant environment
|
||
|
|
mode: autonomous_with_obligations
|
||
|
|
rules: []
|
||
|
|
evidence_required: [provenance]
|
||
|
|
obligations: [record]
|
||
|
|
|
||
|
|
- id: deploy.relied_upon
|
||
|
|
title: Deploy to anything a tenant or external party relies on
|
||
|
|
mode: escalate
|
||
|
|
rules: [C8]
|
||
|
|
|
||
|
|
- id: iam.change
|
||
|
|
title: Change IAM, identities, trust federation, network exposure
|
||
|
|
mode: escalate
|
||
|
|
rules: [C1, C3]
|
||
|
|
|
||
|
|
# --- data and tenants -------------------------------------------------------
|
||
|
|
- id: data.sensitive
|
||
|
|
title: Touch personal, regulated or tenant data
|
||
|
|
mode: escalate
|
||
|
|
rules: [C5]
|
||
|
|
|
||
|
|
- id: tenant.cross
|
||
|
|
title: Cross a tenant boundary
|
||
|
|
mode: deny
|
||
|
|
rules: [C5]
|
||
|
|
variants:
|
||
|
|
- when: { cross_tenant_capability: true }
|
||
|
|
mode: escalate # only an explicit capability, decided above L0
|
||
|
|
|
||
|
|
- id: data.delete_irreversible
|
||
|
|
title: Irreversible deletion of non-disposable data
|
||
|
|
mode: escalate
|
||
|
|
rules: []
|
||
|
|
|
||
|
|
- id: tenant.governance_change
|
||
|
|
title: Change a tenant's governance mode or tenant governance envelope (agents)
|
||
|
|
mode: deny
|
||
|
|
rules: [C3]
|
||
|
|
|
||
|
|
- id: tenant.platform_envelope_change
|
||
|
|
title: Change a platform tenant envelope (any tenant principal, any mode)
|
||
|
|
mode: deny
|
||
|
|
rules: [C14]
|
||
|
|
|
||
|
|
# --- audit and root ---------------------------------------------------------
|
||
|
|
- id: audit.disable
|
||
|
|
title: Disable or truncate audit or logging
|
||
|
|
mode: deny
|
||
|
|
rules: [C11]
|
||
|
|
|
||
|
|
- id: platform.root
|
||
|
|
title: Anything requiring platform-root
|
||
|
|
mode: root_authorization_required
|
||
|
|
rules: [C12]
|