# readonly-github.yaml
#
# Goal: let a sandboxed agent READ from the GitHub REST API but never WRITE.
#       POST / PUT / PATCH / DELETE are blocked by the "read-only" access preset.
#
# Schema matches the official OpenShell quickstart example (verified July 2026):
#   https://github.com/NVIDIA/OpenShell/blob/main/examples/sandbox-policy-quickstart/policy.yaml
# Adapted here as the demo policy for this repo. When OpenShell releases update the
# schema, re-check the file above — `openshell policy set` replaces the ENTIRE policy,
# so every required section must be present.

version: 1

# Filesystem + Landlock. Process identity is intentionally omitted so the active
# compute driver picks it. All three fields below are required by `openshell policy set`.
filesystem_policy:
  include_workdir: true
  read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]   # writes confined to sandbox dirs only

landlock:
  compatibility: best_effort

# Layer-7 network rules: allow read-only REST to the GitHub API, deny the rest.
network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce      # actually block, don't just log
        access: read-only         # GET allowed; POST/PUT/PATCH/DELETE denied
    binaries:
      - { path: /usr/bin/curl }   # scope the rule to curl