tegwick
5c5c298643
- Owner declaration for the profiled fi-daily-research-brief (proposed): inputs, single-commit briefs/** grant, fast-forward-only publication, quality rules, model requirements without env selection, completion evidence and rollback pins. - Decision: origin publication is a typed grant on the run, not an executor default. - docs/sources-egress.yaml: 17 exact host:443 entries for the sandbox, tested for sand-boxer format and drift against the prose allowlist. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 51320@bnt-lap001 Assistant-Session: 9d40b4c7-8e3c-42ee-b755-d658d4640d6c
99 lines
4.2 KiB
YAML
99 lines
4.2 KiB
YAML
# Network egress for the daily research brief sandbox (FI-WP-0005-T03).
|
|
#
|
|
# Machine-readable companion to docs/sources-allowlist.md. The Glas profile
|
|
# for fi-daily-research-brief declares exactly these hosts in
|
|
# network.egress (default: deny). The model provider route is NOT listed
|
|
# here; it belongs to the profile (glas-harness), not to FI.
|
|
#
|
|
# sand-boxer rules (docs/bwrap-egress.md): exact lowercase DNS names, port 443
|
|
# only, no wildcards, no IP literals. Enforcement is by destination, not by
|
|
# path: every host below is a whole-host trust decision. Keep the list minimal.
|
|
#
|
|
# `channel` must appear verbatim in docs/sources-allowlist.md
|
|
# (scripts/test_sources_egress.py enforces this so the two cannot drift).
|
|
version: 1
|
|
hosts:
|
|
# Axis A — frontier & commercial
|
|
- host: openai.com:443
|
|
axes: [A]
|
|
channel: OpenAI / Anthropic / Google / xAI / DeepSeek blogs & release notes
|
|
why: Release notes, model pages, API pricing. Returned 403 to a plain
|
|
client on 2026-09-22 (bot protection); may be unreadable unattended.
|
|
- host: www.anthropic.com:443
|
|
axes: [A]
|
|
channel: OpenAI / Anthropic / Google / xAI / DeepSeek blogs & release notes
|
|
why: News and model announcements (apex redirects here).
|
|
- host: platform.claude.com:443
|
|
axes: [A]
|
|
channel: Model cards for API models
|
|
why: Model overview, context limits, pricing tables (docs.anthropic.com
|
|
now 301-redirects here, 2026-09-22).
|
|
- host: blog.google:443
|
|
axes: [A]
|
|
channel: OpenAI / Anthropic / Google / xAI / DeepSeek blogs & release notes
|
|
why: Gemini release announcements.
|
|
- host: ai.google.dev:443
|
|
axes: [A]
|
|
channel: Official pricing pages
|
|
why: Gemini API models and pricing.
|
|
- host: x.ai:443
|
|
axes: [A]
|
|
channel: OpenAI / Anthropic / Google / xAI / DeepSeek blogs & release notes
|
|
why: Grok release notes. Returned 403 to a plain client on 2026-09-22.
|
|
- host: api-docs.deepseek.com:443
|
|
axes: [A, B]
|
|
channel: OpenAI / Anthropic / Google / xAI / DeepSeek blogs & release notes
|
|
why: DeepSeek news, API pricing and model list.
|
|
- host: arena.ai:443
|
|
axes: [A]
|
|
channel: LMSYS / Arena / artificialanalysis-class charts
|
|
why: Directional leaderboard only; note gaming risk (lmarena.ai
|
|
301-redirects here, 2026-09-22).
|
|
- host: artificialanalysis.ai:443
|
|
axes: [A]
|
|
channel: LMSYS / Arena / artificialanalysis-class charts
|
|
why: Price/performance charts, directional.
|
|
- host: www.swebench.com:443
|
|
axes: [A, D]
|
|
channel: SWE-bench Verified / Live leaderboards
|
|
why: Harness+model pairs.
|
|
# Axis B — edge / local / open
|
|
- host: huggingface.co:443
|
|
axes: [B, C]
|
|
channel: Hugging Face org feeds
|
|
why: Model cards, licenses, sizes via /api/models. No weight download
|
|
(weight CDN hosts are deliberately absent).
|
|
- host: ollama.com:443
|
|
axes: [B]
|
|
channel: llama.cpp, vLLM, MLX, Ollama release notes
|
|
why: Ollama library and release notes.
|
|
# Axes B/C/D — GitHub-hosted releases (llama.cpp, vLLM, MLX, Unsloth, TRL,
|
|
# OpenHands, Aider, SWE-agent, OpenCode, Cline, ...)
|
|
- host: github.com:443
|
|
axes: [B, C, D]
|
|
channel: OpenHands, Aider, SWE-agent, OpenCode, Cline repos/releases
|
|
why: Release pages for runtimes, training tools and harnesses.
|
|
- host: api.github.com:443
|
|
axes: [B, C, D]
|
|
channel: llama.cpp, vLLM, MLX, Ollama release notes
|
|
why: Structured release listing instead of scraping HTML.
|
|
# Axis C — training & specialization
|
|
- host: arxiv.org:443
|
|
axes: [C]
|
|
channel: arXiv cs.LG, cs.CL, cs.AI (recent)
|
|
why: Abstracts and listings.
|
|
- host: export.arxiv.org:443
|
|
axes: [C]
|
|
channel: arXiv cs.LG, cs.CL, cs.AI (recent)
|
|
why: arXiv query API (the sanctioned programmatic endpoint).
|
|
# Axis D — harness & fleet
|
|
- host: modelcontextprotocol.io:443
|
|
axes: [D]
|
|
channel: MCP / tool-protocol standards
|
|
why: MCP specification and changelog.
|
|
# Deliberately absent:
|
|
# - Model provider API hosts (profile-owned route).
|
|
# - Hugging Face / GitHub content CDNs (no weight or asset download in briefs).
|
|
# - Social media / X (allowlist: rumor is not confirmation).
|
|
# - Internal Coulomb repos (sand-boxer, activity-core): read from the
|
|
# checked-out workspace or hub, not over the network.
|