From 4cffd7ded27e418f5665e00d6ea486ce36326571 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 13 Oct 2026 21:55:46 +0200
Subject: [PATCH] Add profile.bwrap-fi-research for the FI research brief
 (GLAS-WP-0016-T02)

Deny-by-default bwrap egress: api.anthropic.com plus the 17 hosts in
freedom-intelligence/docs/sources-egress.yaml. Workspace mirror rw.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 358047@bnt-lap001
Assistant-Session: fad68125-297a-449d-bfa7-cf9cdd49ca1d
---
 profiles/profile.bwrap-fi-research.yaml | 55 +++++++++++++++++++++++++
 tests/test_consumer_profiles.py         | 13 +++++-
 2 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 profiles/profile.bwrap-fi-research.yaml

diff --git a/profiles/profile.bwrap-fi-research.yaml b/profiles/profile.bwrap-fi-research.yaml
new file mode 100644
index 0000000..715715f
--- /dev/null
+++ b/profiles/profile.bwrap-fi-research.yaml
@@ -0,0 +1,55 @@
+# Research-brief venue for glas-harness harness.fi-research-brief@1.0.0
+# (GLAS-WP-0016-T02, freedom-intelligence FI-WP-0005-T05).
+# Egress = the model route (api.anthropic.com) plus exactly the 17 hosts in
+# freedom-intelligence/docs/sources-egress.yaml; keep the two in sync.
+# Declaring egress here does not enable it: ext.bwrap refuses this profile
+# unless the owner extension config allowed_egress is a superset.
+id: profile.bwrap-fi-research
+version: "1.0.0"
+extension: ext.bwrap
+isolation:
+  level: process
+network:
+  default: deny
+  egress:
+    - api.anthropic.com:443
+    - openai.com:443
+    - www.anthropic.com:443
+    - platform.claude.com:443
+    - blog.google:443
+    - ai.google.dev:443
+    - x.ai:443
+    - api-docs.deepseek.com:443
+    - arena.ai:443
+    - artificialanalysis.ai:443
+    - www.swebench.com:443
+    - huggingface.co:443
+    - ollama.com:443
+    - github.com:443
+    - api.github.com:443
+    - arxiv.org:443
+    - export.arxiv.org:443
+    - modelcontextprotocol.io:443
+workspace:
+  mode: mirror
+  access: rw
+scope_default: session
+ttl:
+  default: 4h
+  max: 24h
+  idle_reap: null
+resources:
+  cpu: null
+  memory_mb: null
+setup:
+  instructions: ""
+  secret_refs: []
+placement:
+  prefer: [localhost]
+  fallback: []
+reachability:
+  tunnel: ops-bridge
+  identity: ops-warden
+metadata:
+  cost_class: self-hosted
+  latency_class: standard
diff --git a/tests/test_consumer_profiles.py b/tests/test_consumer_profiles.py
index 1ff5f6a..5c15f30 100644
--- a/tests/test_consumer_profiles.py
+++ b/tests/test_consumer_profiles.py
@@ -17,4 +17,15 @@ def test_profile_build_loads() -> None:
     assert profile.id == "profile.build"
     assert profile.extension == "ext.vm-packer"
     assert "build-registry-token" in profile.setup.secret_refs
-    assert profile.reachability.tunnel == "ops-bridge"
\ No newline at end of file
+    assert profile.reachability.tunnel == "ops-bridge"
+
+def test_profile_bwrap_fi_research_egress() -> None:
+    from sandboxer.extensions.egress import destinations
+
+    profile = load_profile("profile.bwrap-fi-research")
+    assert profile.extension == "ext.bwrap"
+    assert profile.network.default == "deny"
+    egress = profile.network.egress
+    assert len(egress) == len(destinations(egress)) == 18
+    assert "api.anthropic.com:443" in egress
+    assert profile.workspace.access == "rw"