EPIC: neutral network egress tiers (strict/balanced/open) across all sandbox backends

[wz-gsa]

Give every acq sandbox (sbx, msb, future ppp) ONE consistent, deny-by-default egress surface via a neutral network.tier vocabulary, with a curated shared balanced baseline. Design in ADR 0002 (isolation) — patterns PR #299. Approved 3/3 (consensus + tradeoff panel); default set to balanced for sbx/msb backend consistency.

Design (see ADR 0002 / PR #299)

• network.tier = strict | balanced | open; all tiers deny-by-default.
• balanced = deny-by-default + curated SHA-pinned IN-REPO baseline ∪ per-kit caps.network.allow.
• No runtime threat-feed; reputation feed = CI-time check on proposed additions.
• Default balanced (maintainer decision 2026-08-07) — matches sbx baseline + quickstart ADR-0018 msb default-on. strict/open explicitly selectable; GFE SHOULD pin strict.

Existing implementation to adopt (do NOT re-implement)

Bret's feat/msb-balanced-egress (quickstart, ADR-0018) already ships the msb half, default-on:

• Vendored acq.backends/msb-balanced-hosts.txt (verbatim sbx-balanced mirror).
• _acq_msb_balanced_rules_into emitter: --net-default deny + translated --net-rule allow@…, DNS grant, crl*→*.digicert.com widening (logged), SI-10 input hardening, ACQ_MSB_BALANCED_EGRESS toggle.
  The follow-up work should adopt this emitter + host-list under the neutral network.tier contract and decide the canonical baseline location (ADR-0018 anticipates migrating the vendored file into a patterns kit).

Sub-issues

• docs(adr): neutral network egress tiers (strict/balanced/open) for all backends #299 — ADR 0002 (proposed; merge first)
• network-tiers: add neutral network.tier vocab (strict/balanced/open) to hybrid/v1 schema #300 — schema: add network.tier vocab (default balanced)
• network-tiers: add the curated, SHA-pinned 'balanced' baseline allowlist data file #301 — curated SHA-pinned balanced baseline data file (seed from ADR-0018's vendored host list)
• network-tiers: CI reputation check on PROPOSED balanced-allowlist additions #302 — CI reputation check on proposed allowlist additions
• network-tiers: map neutral network.tier to sbx + msb egress primitives; ship balanced default agentic-coding-quickstart#294 — map tier → sbx + msb primitives; adopt Bret's msb emitter under the neutral tier; ship balanced default; tests + docs

Governance

What belongs on the federally-shipped balanced allowlist is a human/CODEOWNERS + security-review decision. Agents propose (with the CI reputation signal); never self-approve.

Sequencing

ADR #299 → schema #300 → baseline #301 + CI #302 (parallel) → quickstart adapter #294 (depends on #300/#301; converge with feat/msb-balanced-egress).

AI-assisted (OpenCode); consensus-reviewed (3/3). Requires human review.

[mogul]

Bret's feat/msb-balanced-egress (quickstart, ADR-0018) already ships the msb half

...in PR form here.

[wz-gsa]

Epic progress:

• network-tiers: add neutral network.tier vocab (strict/balanced/open) to hybrid/v1 schema #300 (network.tier schema vocab) → PR feat(kits): add neutral network.tier vocab (strict/balanced/open) to hybrid/v1 (#300) #313
• network-tiers: add the curated, SHA-pinned 'balanced' baseline allowlist data file #301 (balanced baseline data + schema + validator) + network-tiers: CI reputation check on PROPOSED balanced-allowlist additions #302 (deterministic additions guard, no reputation API — 3/3 consensus rejected a live feed) → PR feat(network-tiers): balanced baseline allowlist + deterministic additions guard (#301, #302) #315 (folded together)
• quickstart docs: public-readiness governance files (SECURITY, CODE_OF_CONDUCT, CONTRIBUTING) #294 (adapter: map tier → sbx/msb, consume this baseline, adopt the merged msb-balanced-egress emitter) — remaining
• ADR 0002 design → PR docs(adr): neutral network egress tiers (strict/balanced/open) for all backends #299

Merge order: #313 (vocab) → #315 (baseline+guard) → quickstart #294. All held for review; the balanced core/extended split needs CODEOWNERS + security eyes.