# OpenSheaf sandbox policy for an agent made in the Sheaf builder.
#
# The agent is the small Python program the builder shows under "The program". Inside this sandbox
# the only address it can reach is Sheaf: it asks Sheaf for each step of thinking and calls Sheaf for
# every tool. OpenSheaf adds the check inside the runtime: every tool call is read on its way out of
# the sandbox and decided by Sheaf first. A call that needs a person is held inside the sandbox; it
# never leaves. The hold appears in the Sheaf console under Held, on the agent's record.
#
# run-agent.sh fills in the key and the host. By hand:
#   openshell sandbox create --name my-agent --from python:3.12-slim --policy policy.yaml \
#       --env SHEAF_KEY=sk_pod_... --no-auto-providers --detach -- sleep infinity

version: 1

filesystem_policy:
  include_workdir: true
  read_only: [/bin, /usr, /lib, /lib64, /proc, /dev/urandom, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]
landlock:
  compatibility: best_effort

network_middlewares:
  sheaf:
    name: Sheaf check
    middleware: sheaf/gate
    order: 10
    config:
      key: "__SHEAF_KEY__"
      base: "__SHEAF_BASE__"
      timeout_secs: 90
    on_error: fail_closed
    endpoints:
      include:
        - "__SHEAF_HOST__"

network_policies:
  sheaf:
    name: Sheaf, the only door
    endpoints:
      - host: "__SHEAF_HOST__"
        port: 443
        protocol: rest
        access: read-write
        enforcement: enforce
    binaries:
      - { path: /usr/local/bin/python3.12 }   # python:3.12-slim; change it if your image differs
      - { path: /usr/bin/python3 }