jb/harness-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nono): add restrictive core policy contract

Browse Source
This commit is contained in:
jb
2026-08-30 12:49:17 -04:00
parent 54c20e2012
commit 90f8090f61
19 changed files with 1862 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/tools/nono-profiles/references/policy-fields.md
+12 -2
View File
@@ -4,9 +4,11 @@ Consult this reference when mapping interview answers into a profile. Treat `non
## Inheritance
Use a single string-valued `extends`. Local profiles may extend `pi-local`, registry profiles such as `nolabs-ai/pi`, or another available profile. Inheritance is transitive.
`extends` accepts one profile name or an ordered, non-empty array of profile names. Nono 0.74 merges multiple parents left to right and resolves each shared transitive ancestor once.
Treat included groups and list-valued capabilities as additive. An empty child list does not establish revocation. To create a narrower policy, derive from a narrower parent and add only the required capabilities.
Treat included groups, environment allow/deny lists, and list-valued capabilities as additive. An empty child list does not establish revocation. Restrictive decisions such as `network.block: true` remain restrictive when parent profiles are combined. To create a narrower policy, derive from a narrower parent and add only the required capabilities. When a trusted generator must combine a fail-closed core with one selected provider, materialize and validate one canonical profile instead of expecting inheritance to widen the blocked core.
Nono 0.74 `profile show --json` omits resolved environment, command-policy, connect-port, and custom-credential fields. Use strict validation plus behavioral `nono run` or `nono why --command` proofs for those capabilities rather than treating the resolved JSON as complete evidence.
## Runtime working directory
@@ -100,6 +102,10 @@ Set networking enabled without a domain allowlist inherited from the chosen pare
State that open mode allows destinations beyond those currently known to the project.
## Exact loopback ports
On Linux with Landlock network support, use `network.connect_port` for outbound-only access to exact TCP ports. Use `network.open_port` only when the sandbox must both connect and bind. A port rule does not establish hostname or credential access; validate those separately. Prove exact enforcement with live listeners on the selected port and an adjacent denied port because strict schema validation alone does not demonstrate kernel enforcement.
## URL opening and service launching
`open_urls.allow_origins` controls origins that sandboxed tools may ask the host to open. `open_urls.allow_localhost` controls localhost URL opening. These capabilities remain separate from direct Internet access.
@@ -116,6 +122,10 @@ The installed `nolabs-ai/pi` parent enables selected OpenAI, Anthropic, and GitH
Treat a credential route as a separate capability from reaching its domain. Confirm both the route and endpoint restrictions. Prefer nono-mediated credential routes over exposing real API keys inside the sandbox.
## Command policies
Place each caller edge under `command_policies.commands.<name>.from.<caller>`. Inherited invocation denials remain restrictive when a child declares a more permissive default, so verify the effective decision with `nono why --profile <profile> --command <name> --caller <caller> --json -- <args>`. Nono 0.74 creates a command-policy supervisor Unix socket under `TMPDIR`; keep the private runtime path short enough for Linux `SUN_LEN` until the tracked limitation is fixed.
## Local sources of truth
Read these when behavior or schema details are uncertain: