Part of the neutral-network-tiers epic (see ADR 0002 isolation, PR #299).
Scope
Add network.tier to schemas/kit-hybrid-v1.schema.json (and/or the acq config schema): enum strict | balanced | open, description that each backend maps it to its native egress primitive, and that all tiers are deny-by-default (tier only sizes the allowlist).
Requirements
- Default when unspecified =
balanced (maintainer decision 2026-08-07 — backend-consistent with sbx baseline + quickstart ADR-0018 msb default-on). balanced stays deny-by-default + curated allowlist, not allow-all.
- Coexists with the existing
caps.network.allow (effective allowlist = tier baseline ∪ per-kit allow ∪ per-sandbox additions).
validate-kits.py accepts/validates the new field; add tests (valid tiers, invalid tier rejected, omission → treated as balanced).- Update INDEX/CATALOG generation if it surfaces network config.
Depends on nothing; unblocks the adapter-mapping + baseline-data issues.
AI-assisted (OpenCode); consensus-reviewed. Requires human review.
Part of the neutral-network-tiers epic (see ADR 0002 isolation, PR #299).
Scope
Add
network.tiertoschemas/kit-hybrid-v1.schema.json(and/or the acq config schema): enumstrict | balanced | open, description that each backend maps it to its native egress primitive, and that all tiers are deny-by-default (tier only sizes the allowlist).Requirements
balanced(maintainer decision 2026-08-07 — backend-consistent with sbx baseline + quickstart ADR-0018 msb default-on).balancedstays deny-by-default + curated allowlist, not allow-all.caps.network.allow(effective allowlist = tier baseline ∪ per-kit allow ∪ per-sandbox additions).validate-kits.pyaccepts/validates the new field; add tests (valid tiers, invalid tier rejected, omission → treated as balanced).Depends on nothing; unblocks the adapter-mapping + baseline-data issues.
AI-assisted (OpenCode); consensus-reviewed. Requires human review.