tegwick
4cffd7ded2
Deny-by-default bwrap egress: api.anthropic.com plus the 17 hosts in freedom-intelligence/docs/sources-egress.yaml. Workspace mirror rw. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 358047@bnt-lap001 Assistant-Session: fad68125-297a-449d-bfa7-cf9cdd49ca1d
55 lines
1.3 KiB
YAML
55 lines
1.3 KiB
YAML
# Research-brief venue for glas-harness harness.fi-research-brief@1.0.0
|
|
# (GLAS-WP-0016-T02, freedom-intelligence FI-WP-0005-T05).
|
|
# Egress = the model route (api.anthropic.com) plus exactly the 17 hosts in
|
|
# freedom-intelligence/docs/sources-egress.yaml; keep the two in sync.
|
|
# Declaring egress here does not enable it: ext.bwrap refuses this profile
|
|
# unless the owner extension config allowed_egress is a superset.
|
|
id: profile.bwrap-fi-research
|
|
version: "1.0.0"
|
|
extension: ext.bwrap
|
|
isolation:
|
|
level: process
|
|
network:
|
|
default: deny
|
|
egress:
|
|
- api.anthropic.com:443
|
|
- openai.com:443
|
|
- www.anthropic.com:443
|
|
- platform.claude.com:443
|
|
- blog.google:443
|
|
- ai.google.dev:443
|
|
- x.ai:443
|
|
- api-docs.deepseek.com:443
|
|
- arena.ai:443
|
|
- artificialanalysis.ai:443
|
|
- www.swebench.com:443
|
|
- huggingface.co:443
|
|
- ollama.com:443
|
|
- github.com:443
|
|
- api.github.com:443
|
|
- arxiv.org:443
|
|
- export.arxiv.org:443
|
|
- modelcontextprotocol.io:443
|
|
workspace:
|
|
mode: mirror
|
|
access: rw
|
|
scope_default: session
|
|
ttl:
|
|
default: 4h
|
|
max: 24h
|
|
idle_reap: null
|
|
resources:
|
|
cpu: null
|
|
memory_mb: null
|
|
setup:
|
|
instructions: ""
|
|
secret_refs: []
|
|
placement:
|
|
prefer: [localhost]
|
|
fallback: []
|
|
reachability:
|
|
tunnel: ops-bridge
|
|
identity: ops-warden
|
|
metadata:
|
|
cost_class: self-hosted
|
|
latency_class: standard
|