mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-27 07:03:17 +08:00
Piotr Mlocek
6cf0264170
Closes #26 ## Summary Consolidates sandbox policy data into `dev-sandbox-policy.yaml` and deletes `dev-sandbox-policy-data.rego`. The YAML file becomes the single source of truth for sandbox policy data across both paths: - **`nav create sandbox`** (CLI reads YAML → proto → gRPC → server stores → sandbox fetches) - **`mise run sandbox`** (sandbox reads YAML directly via regorus) ## Why YAML The policy data file is user-facing — it's the interface users interact with to configure sandbox security policy (allowed endpoints, binary identities, filesystem access, etc.). Keeping this as YAML rather than rego: - **Decouples data from enforcement engine** — if we change from OPA/rego to a different policy engine, the user's data file stays the same - **Still works with regorus** — regorus can natively load YAML data via its `yaml` feature, so there's no conversion step in the local dev path - **Enables future indirection** — we can add a transformation layer between the YAML file and what the policy engine receives, without changing the user-facing format ## Changes ### Policy data (`dev-sandbox-policy.yaml`) - Flat top-level structure: `filesystem_policy`, `landlock`, `process`, `inference`, `network_policies` - Renamed `filesystem` → `filesystem_policy` to match rego/proto convention - Deleted `dev-sandbox-policy-data.rego` (was the rego equivalent of this data) ### Rego rules (`dev-sandbox-policy.rego`) - All data references updated: `data.sandbox.*` → `data.*` (dropped `sandbox.` prefix) - `package navigator.sandbox` unchanged (that's the rego rule namespace, not the data path) ### Sandbox entrypoint (`navigator-sandbox`) - `--rego-policy`/`--rego-data` → `--policy-rules`/`--policy-data` - `NAVIGATOR_REGO_POLICY`/`NAVIGATOR_REGO_DATA` → `NAVIGATOR_POLICY_RULES`/`NAVIGATOR_POLICY_DATA` - `from_files()`: loads YAML natively via `regorus::Value::from_yaml_file()` - `from_strings()` and `reload()`: accept YAML data via `Value::from_yaml_str()` - `proto_to_opa_data_json()`: emits data at root level (no `"sandbox"` wrapper) - Enabled regorus `yaml` feature ### CLI (`navigator-cli`) - `DevSandboxPolicyFile.filesystem` → `filesystem_policy` ### Tests - All inline test data converted from rego/JSON to YAML - `test_engine()` uses `from_strings(rules, yaml)` with the dev YAML file ### Documentation - Updated `architecture/plans/sandbox-policy-refactor/plan.md`, `architecture/plans/opa/plan.md`, `architecture/sandbox.md`, `architecture/containers.md`
40 lines
1.6 KiB
Markdown
40 lines
1.6 KiB
Markdown
# Agent Instructions
|
|
|
|
See [CONTRIBUTING.md](CONTRIBUTING.md) for instructions on how to perform common operations (building, testing, linting, running components).
|
|
|
|
## Plans
|
|
|
|
- Store plan documents in `architecture/plans`.
|
|
- When asked to write a plan, write it there without asking for the location.
|
|
|
|
## Sandbox Infra Changes
|
|
|
|
- If you change sandbox infrastructure, ensure `mise run sandbox` succeeds.
|
|
|
|
## Commits
|
|
|
|
- Always use [Conventional Commits](https://www.conventionalcommits.org/) format for commit messages
|
|
- Format: `<type>(<scope>): <description>` (scope is optional)
|
|
- Common types: `feat`, `fix`, `docs`, `chore`, `refactor`, `test`, `ci`, `perf`
|
|
- Never mention Claude or any AI agent in commits (no author attribution, no Co-Authored-By, no references in commit messages)
|
|
|
|
## Pre-commit
|
|
|
|
- Run `mise run pre-commit` before committing.
|
|
- Install the git hook when working locally: `mise generate git-pre-commit --write --task=pre-commit`
|
|
|
|
## Python
|
|
|
|
- Always use `uv` for Python commands (e.g., `uv pip install`, `uv run`, `uv venv`)
|
|
|
|
## Docker
|
|
|
|
- Always prefer `mise` commands over direct docker builds (e.g., `mise run docker:build` instead of `docker build`)
|
|
|
|
## Cluster Infrastructure Changes
|
|
|
|
- If you change cluster bootstrap infrastructure (e.g., `navigator-bootstrap` crate, `Dockerfile.cluster`, `cluster-entrypoint.sh`, `cluster-healthcheck.sh`, deploy logic in `navigator-cli`), update the `debug-navigator-cluster` skill in `.agent/skills/debug-navigator-cluster/SKILL.md` to reflect those changes.
|
|
|
|
## Documentation
|
|
|
|
- When making changes, update the relevant documentation in the `architecture/` directory. |