feat(policy): bind the accepted Pi trust boundary to a contract check

The Pi baseline policy already denies everything except the managed
inference route, and the manifest already keeps project trust out of
portable state. Nothing held either in place: the policy file was
reachable from one existence check, so a direct provider endpoint, a
package registry, an agent-writable network binary, a container-runtime
socket, a relaxed Landlock mode, a privileged process identity, a
dropped non-interactive approval flag, or a restorable project-trust
decision would all have passed review unchallenged.

The candidate artifact check now parses the policy and the manifest and
binds each of those boundaries, so weakening one fails the check rather
than the next release. A catalog preset name stays outside the Pi
baseline, which keeps external access an explicit policy selection.

Signed-off-by: Tinson Lai <tinsonl@nvidia.com>

Author: laitingsheng

scripts/checks/pi-candidate-artifacts.mts

@@ -11,6 +11,12 @@
  * one exact package version and integrity value, and verifies that the
  * candidate contract artifact name stays outside the all-agent cohort download
  * pattern.
+ *
+ * It also binds the accepted Pi trust boundary: the baseline permits only the
+ * managed inference route from root-owned image binaries, writable paths stay
+ * on the declared sandbox state, non-interactive runs keep passing the flag
+ * that ignores project-local resources, and neither the project-trust store nor
+ * the project-trust setting can travel through backup and restore.
  */
 
 import { createHash } from "node:crypto";
@@ -24,6 +30,23 @@ const MANAGED_IMAGE_CONTRACT_PATH = "src/lib/onboard/managed-image/contract.ts";
 const PI_PACKAGE = "@earendil-works/pi-coding-agent";
 const COHORT_CONTRACT_ARTIFACT_PREFIX = "managed-pr-contract-";
 const CANDIDATE_CONTRACT_ARTIFACT_PREFIX = "managed-candidate-contract-";
+const PI_MANIFEST_PATH = "agents/pi/manifest.yaml";
+const PI_POLICY_PATH = "agents/pi/policy-additions.yaml";
+
+const MANAGED_INFERENCE_POLICY = "managed_inference";
+const MANAGED_INFERENCE_HOST = "inference.local";
+const MANAGED_INFERENCE_PORT = 443;
+const APPROVED_NETWORK_BINARIES = [
+  "/usr/local/bin/node",
+  "/usr/local/bin/pi",
+  "/usr/local/lib/nemoclaw/pi-runtime/**",
+];
+const APPROVED_READ_WRITE_PATHS = ["/dev/null", "/sandbox", "/sandbox/.pi", "/tmp"];
+const REQUIRED_LANDLOCK_COMPATIBILITY = "strict";
+const REQUIRED_SANDBOX_IDENTITY = "sandbox";
+const NON_INTERACTIVE_APPROVAL_FLAG = "--no-approve";
+const PROJECT_TRUST_STORE = "trust.json";
+const PROJECT_TRUST_SETTING = "defaultProjectTrust";
 
 const REQUIRED_ARTIFACTS = [
   "agents/pi/Dockerfile",
@@ -46,6 +69,7 @@ export type PiArtifactSources = Readonly<{
   managedImagesWorkflow: string;
   manifest: string;
   packageJson: string;
+  policyAdditions: string;
 }>;
 
 function readDockerfileArg(source: string, name: string): string | null {
@@ -228,12 +252,156 @@ function verifyCohortSeparation(workflow: string): string[] {
   return failures;
 }
 
+type LooseRecord = Record<string, unknown>;
+
+function asRecord(value: unknown): LooseRecord {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as LooseRecord)
+    : {};
+}
+
+function sortedStrings(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry): entry is string => typeof entry === "string").sort();
+}
+
+function sameSet(actual: readonly string[], approved: readonly string[]): boolean {
+  return actual.length === approved.length && actual.every((entry, index) => entry === approved[index]);
+}
+
+function verifyNetworkBoundary(policy: LooseRecord): string[] {
+  const failures: string[] = [];
+  const networkPolicies = asRecord(policy.network_policies);
+  const declared = Object.keys(networkPolicies).sort();
+  if (!sameSet(declared, [MANAGED_INFERENCE_POLICY])) {
+    failures.push(
+      `${PI_POLICY_PATH}: the baseline must declare only ${MANAGED_INFERENCE_POLICY}, found ${declared.join(", ") || "none"}`,
+    );
+    return failures;
+  }
+  const managed = asRecord(networkPolicies[MANAGED_INFERENCE_POLICY]);
+  const endpoints = Array.isArray(managed.endpoints) ? managed.endpoints : [];
+  if (endpoints.length !== 1) {
+    failures.push(`${PI_POLICY_PATH}: ${MANAGED_INFERENCE_POLICY} must declare exactly one endpoint`);
+  }
+  for (const entry of endpoints) {
+    const endpoint = asRecord(entry);
+    if (endpoint.host !== MANAGED_INFERENCE_HOST || endpoint.port !== MANAGED_INFERENCE_PORT) {
+      failures.push(
+        `${PI_POLICY_PATH}: the baseline permits only ${MANAGED_INFERENCE_HOST}:${String(MANAGED_INFERENCE_PORT)}`,
+      );
+    }
+    if (endpoint.enforcement !== "enforce") {
+      failures.push(`${PI_POLICY_PATH}: ${MANAGED_INFERENCE_HOST} must stay enforced, not observed`);
+    }
+    const rules = Array.isArray(endpoint.rules) ? endpoint.rules : [];
+    for (const rule of rules) {
+      const allow = asRecord(asRecord(rule).allow);
+      const rulePath = typeof allow.path === "string" ? allow.path : "";
+      if (!Object.hasOwn(asRecord(rule), "allow") || !rulePath.startsWith("/v1/")) {
+        failures.push(
+          `${PI_POLICY_PATH}: every managed inference rule must allow an explicit /v1/ route, found ${rulePath || "an unreadable rule"}`,
+        );
+      }
+    }
+  }
+  const binaries = sortedStrings(
+    Array.isArray(managed.binaries)
+      ? managed.binaries.map((entry) => asRecord(entry).path)
+      : [],
+  );
+  if (!sameSet(binaries, APPROVED_NETWORK_BINARIES)) {
+    failures.push(
+      `${PI_POLICY_PATH}: network capability must stay on the root-owned image binaries ${APPROVED_NETWORK_BINARIES.join(", ")}`,
+    );
+  }
+  return failures;
+}
+
+function verifyFilesystemBoundary(policy: LooseRecord): string[] {
+  const failures: string[] = [];
+  const filesystem = asRecord(policy.filesystem_policy);
+  const readWrite = sortedStrings(filesystem.read_write);
+  if (!sameSet(readWrite, APPROVED_READ_WRITE_PATHS)) {
+    failures.push(
+      `${PI_POLICY_PATH}: writable paths must stay ${APPROVED_READ_WRITE_PATHS.join(", ")}, found ${readWrite.join(", ") || "none"}`,
+    );
+  }
+  if (asRecord(policy.landlock).compatibility !== REQUIRED_LANDLOCK_COMPATIBILITY) {
+    failures.push(
+      `${PI_POLICY_PATH}: landlock.compatibility must be ${REQUIRED_LANDLOCK_COMPATIBILITY} so filesystem policy fails closed`,
+    );
+  }
+  const process = asRecord(policy.process);
+  if (
+    process.run_as_user !== REQUIRED_SANDBOX_IDENTITY ||
+    process.run_as_group !== REQUIRED_SANDBOX_IDENTITY
+  ) {
+    failures.push(`${PI_POLICY_PATH}: Pi must run as the ${REQUIRED_SANDBOX_IDENTITY} user and group`);
+  }
+  return failures;
+}
+
+function verifyApprovalBoundary(manifest: LooseRecord): string[] {
+  const failures: string[] = [];
+  const runtime = asRecord(manifest.runtime);
+  const headless = typeof runtime.headless_command === "string" ? runtime.headless_command : "";
+  if (!headless.split(/\s+/u).includes(NON_INTERACTIVE_APPROVAL_FLAG)) {
+    failures.push(
+      `${PI_MANIFEST_PATH}: runtime.headless_command must pass ${NON_INTERACTIVE_APPROVAL_FLAG} so non-interactive runs ignore project-local resources`,
+    );
+  }
+  if (asRecord(manifest.mcp).support !== "disabled") {
+    failures.push(`${PI_MANIFEST_PATH}: mcp.support must stay disabled for the accepted v1 surface`);
+  }
+  if (manifest.device_pairing !== false) {
+    failures.push(`${PI_MANIFEST_PATH}: device_pairing must stay false for the accepted v1 surface`);
+  }
+  return failures;
+}
+
+function verifyProjectTrustBoundary(manifest: LooseRecord): string[] {
+  const failures: string[] = [];
+  const stateDirs = Array.isArray(manifest.state_dirs) ? manifest.state_dirs : [];
+  const stateFiles = Array.isArray(manifest.state_files) ? manifest.state_files : [];
+  const declared = [...stateDirs, ...stateFiles].map((entry) => asRecord(entry).path);
+  if (declared.includes(PROJECT_TRUST_STORE)) {
+    failures.push(
+      `${PI_MANIFEST_PATH}: ${PROJECT_TRUST_STORE} must stay undeclared so a restore cannot carry a project-trust decision`,
+    );
+  }
+  for (const entry of stateFiles) {
+    const stateFile = asRecord(entry);
+    const userKeys = Array.isArray(asRecord(stateFile.restore).user_keys)
+      ? (asRecord(stateFile.restore).user_keys as unknown[])
+      : [];
+    if (userKeys.map((key) => asRecord(key).key).includes(PROJECT_TRUST_SETTING)) {
+      failures.push(
+        `${PI_MANIFEST_PATH}: ${PROJECT_TRUST_SETTING} must stay outside the restore allowlist so a backup cannot widen project trust`,
+      );
+    }
+  }
+  return failures;
+}
+
+export function verifyPiTrustBoundary(sources: PiArtifactSources): string[] {
+  const policy = asRecord(parseYaml(sources.policyAdditions));
+  const manifest = asRecord(parseYaml(sources.manifest));
+  return [
+    ...verifyNetworkBoundary(policy),
+    ...verifyFilesystemBoundary(policy),
+    ...verifyApprovalBoundary(manifest),
+    ...verifyProjectTrustBoundary(manifest),
+  ];
+}
+
 export function verifyPiCandidateArtifacts(sources: PiArtifactSources): string[] {
   return [
     ...verifyPinnedIdentity(sources),
     ...verifyCandidateRegistration(sources.managedImageContract),
     ...verifyCohortSeparation(sources.managedImagesWorkflow),
     ...verifyManagedImageDeclaration(sources),
+    ...verifyPiTrustBoundary(sources),
   ];
 }
 
@@ -256,8 +424,9 @@ function main(): void {
     lock: readRepoFile("agents/pi/pi-runtime/package-lock.json"),
     managedImageContract: readRepoFile(MANAGED_IMAGE_CONTRACT_PATH),
     managedImagesWorkflow: readRepoFile(".github/workflows/managed-images.yaml"),
-    manifest: readRepoFile("agents/pi/manifest.yaml"),
+    manifest: readRepoFile(PI_MANIFEST_PATH),
     packageJson: readRepoFile("agents/pi/pi-runtime/package.json"),
+    policyAdditions: readRepoFile(PI_POLICY_PATH),
   });
   if (failures.length > 0) {
     console.error(failures.join("\n"));

src/lib/policy/agent-base-preset.test.ts

@@ -66,4 +66,14 @@ describe("agent base preset detection", () => {
 
     expect(isAgentBasePreset("hermes", "pypi")).toBe(true);
   });
+
+  it("keeps a catalog preset outside the Pi baseline so external access stays an explicit choice (#7924)", () => {
+    const piPolicy = fs.readFileSync(path.join(AGENTS_DIR, "pi", "policy-additions.yaml"), "utf8");
+    const agent = createAgentFixture(piPolicy);
+    vi.spyOn(registry, "getSandbox").mockReturnValue({ name: "pi", agent } as never);
+
+    expect(isAgentBasePreset("pi", "managed_inference")).toBe(true);
+    expect(isAgentBasePreset("pi", "pypi")).toBe(false);
+    expect(isAgentBasePreset("pi", "github")).toBe(false);
+  });
 });

test/pi-candidate-runtime-artifacts.test.ts

@@ -11,6 +11,7 @@ import YAML from "yaml";
 import {
   type PiArtifactSources,
   verifyPiCandidateArtifacts,
+  verifyPiTrustBoundary,
 } from "../scripts/checks/pi-candidate-artifacts.mts";
 import {
   CANDIDATE_MANAGED_IMAGE_AGENTS,
@@ -34,9 +35,24 @@ function currentSources(): PiArtifactSources {
     managedImagesWorkflow: readRepoFile(".github/workflows/managed-images.yaml"),
     manifest: readRepoFile("agents/pi/manifest.yaml"),
     packageJson: readRepoFile("agents/pi/pi-runtime/package.json"),
+    policyAdditions: readRepoFile("agents/pi/policy-additions.yaml"),
   };
 }
 
+function withPolicy(mutate: (policy: Record<string, any>) => void): PiArtifactSources {
+  const sources = currentSources();
+  const policy = YAML.parse(sources.policyAdditions);
+  mutate(policy);
+  return { ...sources, policyAdditions: YAML.stringify(policy) };
+}
+
+function withManifest(mutate: (manifest: Record<string, any>) => void): PiArtifactSources {
+  const sources = currentSources();
+  const manifest = YAML.parse(sources.manifest);
+  mutate(manifest);
+  return { ...sources, manifest: YAML.stringify(manifest) };
+}
+
 const DIGEST = `sha256:${"a".repeat(64)}`;
 
 function candidateContract(overrides: Record<string, unknown> = {}): Record<string, unknown> {
@@ -191,17 +207,123 @@ describe("Pi candidate contract validation", () => {
 });
 
 describe("Pi runtime boundaries", () => {
-  const APPROVED_MANAGED_INFERENCE_BINARY_PATHS = [
-    "/usr/local/bin/pi",
-    "/usr/local/bin/node",
-    "/usr/local/lib/nemoclaw/pi-runtime/**",
-  ];
+  it("accepts the trust boundary committed in this repository (#7924)", () => {
+    expect(verifyPiTrustBoundary(currentSources())).toEqual([]);
+  });
+
+  it("denies a direct provider endpoint added beside the managed route (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.network_policies.managed_inference.endpoints.push({
+        host: "api.openai.com",
+        port: 443,
+        protocol: "rest",
+        enforcement: "enforce",
+        rules: [{ allow: { method: "POST", path: "/v1/chat/completions" } }],
+      });
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/policy-additions.yaml: the baseline permits only inference.local:443",
+    );
+  });
+
+  it("denies a package registry policy the baseline never selected (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.network_policies.npm_registry = {
+        name: "npm_registry",
+        endpoints: [{ host: "registry.npmjs.org", port: 443, enforcement: "enforce", rules: [] }],
+      };
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/policy-additions.yaml: the baseline must declare only managed_inference, found managed_inference, npm_registry",
+    );
+  });
+
+  it("denies network capability to a binary the agent can write (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.network_policies.managed_inference.binaries.push({ path: "/sandbox/agent-proxy" });
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/policy-additions.yaml: network capability must stay on the root-owned image binaries /usr/local/bin/node, /usr/local/bin/pi, /usr/local/lib/nemoclaw/pi-runtime/**",
+    );
+  });
+
+  it("denies a rule that widens the managed route beyond its versioned paths (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.network_policies.managed_inference.endpoints[0].rules.push({
+        allow: { method: "GET", path: "/**" },
+      });
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/policy-additions.yaml: every managed inference rule must allow an explicit /v1/ route, found /**",
+    );
+  });
+
+  it("denies a container-runtime socket added to the writable paths (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.filesystem_policy.read_write.push("/var/run/docker.sock");
+    });
+    expect(verifyPiTrustBoundary(sources).join("\n")).toContain(
+      "writable paths must stay /dev/null, /sandbox, /sandbox/.pi, /tmp",
+    );
+  });
+
+  it("denies a relaxed Landlock compatibility that would start with policy unenforced (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.landlock.compatibility = "best-effort";
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/policy-additions.yaml: landlock.compatibility must be strict so filesystem policy fails closed",
+    );
+  });
 
-  it("excludes an agent-writable binary path from the approved allowlist", () => {
-    expect(APPROVED_MANAGED_INFERENCE_BINARY_PATHS).not.toContain("/tmp/agent-proxy");
-    expect(APPROVED_MANAGED_INFERENCE_BINARY_PATHS).not.toContain("/sandbox/agent-proxy");
+  it("denies host control by refusing a privileged process identity (#7924)", () => {
+    const sources = withPolicy((policy) => {
+      policy.process.run_as_user = "root";
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/policy-additions.yaml: Pi must run as the sandbox user and group",
+    );
+  });
+
+  it("denies a non-interactive command that stops ignoring project-local resources (#7924)", () => {
+    const sources = withManifest((manifest) => {
+      manifest.runtime.headless_command = "pi --print";
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/manifest.yaml: runtime.headless_command must pass --no-approve so non-interactive runs ignore project-local resources",
+    );
   });
 
+  it("denies an MCP surface the accepted v1 scope excludes (#7924)", () => {
+    const sources = withManifest((manifest) => {
+      manifest.mcp.support = "enabled";
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/manifest.yaml: mcp.support must stay disabled for the accepted v1 surface",
+    );
+  });
+
+  it("denies a project-trust store that a restore could carry into a new sandbox (#7924)", () => {
+    const sources = withManifest((manifest) => {
+      manifest.state_files.push({ path: "trust.json" });
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/manifest.yaml: trust.json must stay undeclared so a restore cannot carry a project-trust decision",
+    );
+  });
+
+  it("denies a restore allowlist that could widen project trust (#7924)", () => {
+    const sources = withManifest((manifest) => {
+      manifest.state_files[0].restore.user_keys.push({
+        key: "defaultProjectTrust",
+        type: "enum",
+        values: ["ask", "always", "never"],
+      });
+    });
+    expect(verifyPiTrustBoundary(sources)).toContain(
+      "agents/pi/manifest.yaml: defaultProjectTrust must stay outside the restore allowlist so a backup cannot widen project trust",
+    );
+  });
 });
 
 describe("Pi managed model catalog generation", () => {