README
¶
Policy contract
This package owns AgentSuite policy meaning. It strictly validates SuitePolicy, composes administrative restrictions without weakening, emits exact canonical EffectivePolicy bytes, and creates a domain-separated digest. Consumers preserve the bytes rather than reserializing them.
filesystem/deny-write/v1 requires denial of create, writable open/write, truncate, rename effects, unlink, link, metadata and symlink mutation, including declared mount/path bypass coverage. A provider must reject the policy when it cannot cover the full required operation set.
Language-neutral vector
testdata/effective-policy-v1.json contains the exact canonical UTF-8 bytes for a composed example. testdata/effective-policy-v1.sha256 contains the expected domain-separated digest. Implementations must consume the JSON file bytes directly, not parse and reserialize them before digest verification.
Documentation
¶
Overview ¶
Copyright (c) Kaimahi contributors. Licensed under the MIT License. Package policy defines AgentSuite enforcement policy contracts.
Index ¶
Constants ¶
const ( SchemaVersion = "agentsuite.policy/v1" FilesystemDenyWrite = "filesystem/deny-write/v1" )
Variables ¶
This section is empty.
Functions ¶
func CanonicalBytes ¶
func CanonicalBytes(p EffectivePolicy) ([]byte, error)
CanonicalBytes emits at most 4 MiB of deterministic UTF-8 JSON for a fully valid effective policy.
func Validate ¶
func Validate(p SuitePolicy) error
func VerifyPayload ¶
func VerifyPayload(p ProviderPayload) error
Types ¶
type AdministrativePolicy ¶
type AdministrativePolicy struct {
DenyWritePaths []string `json:"denyWritePaths,omitempty"`
}
AdministrativePolicy adds mandatory restrictions; composition never removes user restrictions.
func DecodeAdministrativePolicy ¶
func DecodeAdministrativePolicy(data []byte) (AdministrativePolicy, error)
DecodeAdministrativePolicy applies the same closed JSON rules as suite policy decoding.
type EffectivePolicy ¶
type EffectivePolicy struct {
Version string `json:"version"`
DenyWritePaths []string `json:"denyWritePaths"`
RequiredCapabilities []string `json:"requiredCapabilities"`
}
EffectivePolicy is normalized, fully composed policy.
func Resolve ¶
func Resolve(s SuitePolicy, a AdministrativePolicy) (EffectivePolicy, error)
Resolve validates and monotonically composes requested and administrative restrictions.
type ProviderPayload ¶
type ProviderPayload struct {
Version string `json:"version"`
PolicyBytes []byte `json:"policyBytes"`
PolicyDigest string `json:"policyDigest"`
RequiredCapabilities []string `json:"requiredCapabilities"`
}
ProviderPayload carries authoritative canonical bytes. Consumers must preserve PolicyBytes.
func Payload ¶
func Payload(p EffectivePolicy) (ProviderPayload, error)
type SuitePolicy ¶
type SuitePolicy struct {
Version string `json:"version"`
DenyWritePaths []string `json:"denyWritePaths"`
RequiredCapabilities []string `json:"requiredCapabilities,omitempty"`
}
SuitePolicy is strict user intent. DenyWritePaths is a set of absolute paths.
func DecodeSuitePolicy ¶
func DecodeSuitePolicy(data []byte) (SuitePolicy, error)
DecodeSuitePolicy strictly decodes exactly one JSON object.
Source Files