Repository navigation
network-tiers: add neutral network.tier vocab (strict/balanced/open) to hybrid/v1 schema #300
Description
Part of the neutral-network-tiers epic (see ADR 0002 isolation, PR #299).
Scope
Add network.tier to schemas/kit-hybrid-v1.schema.json (and/or the acq config schema): enum strict | balanced | open, description that each backend maps it to its native egress primitive, and that all tiers are deny-by-default (tier only sizes the allowlist).
Requirements
- Default when unspecified =
balanced(maintainer decision 2026-08-07 — backend-consistent with sbx baseline + quickstart ADR-0018 msb default-on).balancedstays deny-by-default + curated allowlist, not allow-all. - Coexists with the existing
caps.network.allow(effective allowlist = tier baseline ∪ per-kit allow ∪ per-sandbox additions). validate-kits.pyaccepts/validates the new field; add tests (valid tiers, invalid tier rejected, omission → treated as balanced).- Update INDEX/CATALOG generation if it surfaces network config.
Depends on nothing; unblocks the adapter-mapping + baseline-data issues.
AI-assisted (OpenCode); consensus-reviewed. Requires human review.
Activity
mogul commentedon Aug 7, 2026
What happens when one kit specifies
strictand another specifiesbalanced?wz-gsa commentedon Aug 11, 2026
Implemented in the PR above. Added
caps.network.tier(enum strict|balanced|open, default balanced) to the hybrid/v1 schema + a validate-kits field-level message; coexists withcaps.network.allow; default documented not mutated. 12 new tests, 322 pass, make validate green. Unblocks #301 + quickstart #294.mogul commentedon Aug 11, 2026
Not clear to me... was that an answer to my post, or just a status report?
feat(network-tiers): add curated 'balanced' baseline allowlist + vali…
feat(network-tiers): balanced baseline allowlist + deterministic addi…