mirror of
https://github.com/Heretek-AI/heretek-rigs.git
synced 2026-11-09 17:15:24 -10:00
John Smith
393a81d3fc
EVENTS/VERSION deny already landed in 91f0775; this commit bakes the prior-pass verifier hardening + deterministic regen digests that were carried as dirty leaves: - scripts/verify-rigs.sh + scripts/gate-role.sh + scripts/render-seat.py hardening (fail-closed guards, 22-check gate green) - Makefile bash-prefix, schemas/, tests/test_render_seat.py - specs/ + rigs/ + registry/ deterministic regen leaves (51 AgentSpecs / 8 RigBundles green, digests synchronized) - intentional toolchain files: opencode.json, scripts/compose-sidecars.sh, claude/RETIRED.md, gemini/RETIRED.md - audit + log leaves: AUDIT_REPORT_FINDINGS.md (current triad report), REMEDIATION_LOG.md, docs/NOTES.md, PROMPT_ADVERSARIAL_FLEET_AUDIT.md, gemini/osint_ecosystem_report.md Left untracked by design: .opencode/opencode-loop/ses_*.json local session scratch (not toolchain).
169 lines
3.8 KiB
JSON
169 lines
3.8 KiB
JSON
{
|
|
"$schema": "https://opencode.ai/config.json",
|
|
"permissions": [
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 scripts/generate-rigs.py *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 ./scripts/generate-rigs.py *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "bash ./scripts/verify-rigs.sh *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "./scripts/verify-rigs.sh *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "bash scripts/verify-rigs.sh *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 ./scripts/audit_loop.py *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 scripts/audit_loop.py *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "bash ./scripts/bootstrap-pi-seats.sh *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "./scripts/bootstrap-pi-seats.sh *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 ./scripts/seed-rig.py *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 ./scripts/render-seat.py *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "python3 -m unittest *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "git ls-files *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "git status *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "git diff *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "rg *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "find *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "test *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "make guard-profiles *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "git ls-remote *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "timeout *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "pip index *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "npm view *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "chmod 600 *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "chmod 644 *",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "shell",
|
|
"resource": "printf *seat-test*",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"action": "external_directory",
|
|
"resource": "/tmp/heretek-seat-test/*",
|
|
"effect": "allow"
|
|
}
|
|
],
|
|
"permission": {
|
|
"bash": {
|
|
"python3 scripts/generate-rigs.py *": "allow",
|
|
"python3 ./scripts/generate-rigs.py *": "allow",
|
|
"bash ./scripts/verify-rigs.sh *": "allow",
|
|
"./scripts/verify-rigs.sh *": "allow",
|
|
"bash scripts/verify-rigs.sh *": "allow",
|
|
"python3 ./scripts/audit_loop.py *": "allow",
|
|
"python3 scripts/audit_loop.py *": "allow",
|
|
"bash ./scripts/bootstrap-pi-seats.sh *": "allow",
|
|
"./scripts/bootstrap-pi-seats.sh *": "allow",
|
|
"python3 ./scripts/seed-rig.py *": "allow",
|
|
"python3 ./scripts/render-seat.py *": "allow",
|
|
"python3 -m unittest *": "allow",
|
|
"git ls-files *": "allow",
|
|
"rg *": "allow",
|
|
"find *": "allow",
|
|
"test *": "allow",
|
|
"make guard-profiles *": "allow",
|
|
"git ls-remote *": "allow",
|
|
"timeout *": "allow",
|
|
"pip index *": "allow",
|
|
"npm view *": "allow",
|
|
"chmod 600 *": "allow",
|
|
"chmod 644 *": "allow",
|
|
"printf *seat-test*": "allow"
|
|
}
|
|
}
|
|
}
|