# Default envelope for an L0 coding agent on an explicit human task
# in a HOT build-mode estate (canon A6).
#
# Semantics
# - mode: autonomous | autonomous_with_obligations | escalate | deny | root_authorization_required
# - variants: evaluated top to bottom against request attributes; first match replaces
#   the row's mode (and obligations / evidence_required / rules when given).
# - deny and root_authorization_required rows are constitutional: they apply in EVERY
#   scope (any temperature, any tenant) and no registry delegation overrides them.
# - All other rows apply only where `applies_when` matches. Elsewhere only explicit
#   delegations (registry, platform tenant envelope) grant anything.
# - escalate means "not delegated here": the decision goes to the delegator with
#   blocking_condition no_delegation, unless a registry delegation covers the class.
apiVersion: emergent-security/v0.8
kind: DefaultEnvelope
id: envelope://default/build-hot/L0
canon: "0.8"
delegator: task_assigner        # the human who assigned the task, within their own authority
applies_when:
  level: L0
  temperature: hot
  phase: build
  tenant: none
risk_envelope:
  blast_radius: repository
  tenant_reach: none
  data_sensitivity: internal
  irreversible: false
  external_exposure: none

classes:
  # --- code and tests -------------------------------------------------------
  - id: code.edit
    title: Edit code inside task scope
    mode: autonomous
    rules: [C4]

  - id: test.add
    title: Add or strengthen tests
    mode: autonomous
    rules: [C8]

  - id: test.weaken
    title: Delete, skip or weaken tests or assertions
    mode: escalate
    rules: [C3, C8]
    variants:
      - when: { stated_task: true }
        mode: autonomous

  # --- dependencies and external code ----------------------------------------
  - id: dependency.add
    title: Add or update a dependency
    mode: escalate
    rules: [C9]
    variants:
      - when: { source: standard_registry, pinned: true }
        mode: autonomous_with_obligations
        rules: [C6]
        evidence_required: [lockfile_updated]
        obligations: [record]

  - id: code.fetch_execute
    title: Run code fetched at runtime (curl | sh, unpinned remote scripts, unknown binaries)
    mode: escalate
    rules: [C9]

  - id: data.egress
    title: Send repository content, data or credentials to an external service not named in the task
    mode: escalate
    rules: [C5]

  # --- git -----------------------------------------------------------------
  - id: git.commit_feature
    title: Commit to a feature branch
    mode: autonomous
    rules: []

  - id: git.push_feature
    title: Push a feature branch
    mode: autonomous
    rules: []

  - id: git.merge_protected
    title: Merge into a protected or default branch
    mode: escalate
    rules: [C4]

  - id: git.history_rewrite
    title: Force-push or rewrite shared history
    mode: escalate
    rules: [C11]
    variants:
      - when: { branch_protected: true }
        mode: deny

  # --- CI, checks, policy ----------------------------------------------------
  - id: ci.add_check
    title: Add CI checks, hooks, linters
    mode: autonomous
    rules: [C8]

  - id: ci.weaken
    title: Modify CI so that checks are weaker, skipped or conditional
    mode: escalate
    rules: [C3, C9]

  - id: checks.bypass
    title: Bypass hooks or checks (--no-verify, skip flags, || true on checks)
    mode: deny
    rules: [C3, C9]

  - id: policy.edit
    title: Edit own permission config, agent instructions governing itself, CODEOWNERS, branch protection, delegation registry, policy or discovery files
    mode: deny                  # direction: widen, or unknown
    rules: [C3]
    variants:
      - when: { direction: narrow }
        mode: autonomous
      - when: { direction: propose }
        mode: autonomous_with_obligations
        obligations: [human_review, no_self_merge]

  # --- secrets and credentials ------------------------------------------------
  - id: secrets.read
    title: Read secrets through a broker for the task
    mode: escalate
    rules: [C6]
    variants:
      - when: { via_broker: true }
        mode: autonomous_with_obligations
        obligations: [shortest_ttl, record]

  - id: secrets.write
    title: Write secrets to code, config, logs, prompts, memory or commits
    mode: deny
    rules: [C2, C6]

  - id: credential.reuse_broader
    title: Reuse a broader credential that happens to be available
    mode: deny
    rules: [C2, C7]

  # --- environments, agents, deployment ---------------------------------------
  - id: env.disposable
    title: Create or destroy disposable environments, sandboxes, runners
    mode: escalate
    rules: []
    variants:
      - when: { owned_by_self: true }
        mode: autonomous

  - id: agent.delegate
    title: Hand work to a subagent or another agent
    mode: deny                  # wider than own envelope, or unknown
    rules: [C3, C6]
    variants:
      - when: { within_own_envelope: true, same_task_scope: true }
        mode: autonomous

  - id: deploy.internal
    title: Deploy to an internal, reversible, non-tenant environment
    mode: autonomous_with_obligations
    rules: []
    evidence_required: [provenance]
    obligations: [record]

  - id: deploy.relied_upon
    title: Deploy to anything a tenant or external party relies on
    mode: escalate
    rules: [C8]

  - id: iam.change
    title: Change IAM, identities, trust federation, network exposure
    mode: escalate
    rules: [C1, C3]

  # --- data and tenants -------------------------------------------------------
  - id: data.sensitive
    title: Touch personal, regulated or tenant data
    mode: escalate
    rules: [C5]

  - id: tenant.cross
    title: Cross a tenant boundary
    mode: deny
    rules: [C5]
    variants:
      - when: { cross_tenant_capability: true }
        mode: escalate          # only an explicit capability, decided above L0

  - id: data.delete_irreversible
    title: Irreversible deletion of non-disposable data
    mode: escalate
    rules: []

  - id: tenant.governance_change
    title: Change a tenant's governance mode or tenant governance envelope (agents)
    mode: deny
    rules: [C3]

  - id: tenant.platform_envelope_change
    title: Change a platform tenant envelope (any tenant principal, any mode)
    mode: deny
    rules: [C14]

  # --- audit and root ---------------------------------------------------------
  - id: audit.disable
    title: Disable or truncate audit or logging
    mode: deny
    rules: [C11]

  - id: platform.root
    title: Anything requiring platform-root
    mode: root_authorization_required
    rules: [C12]