dtoro
b230ab5937
Adds the Oikos agent-OS kernel: oikos/policy.yaml (risk classes + approval rules for every homelab/MCP command), oikos/ontology.yaml (8-domain systems model, typed relationships, node lifecycle), and OIKOS.md (OODA loop operating brief, linked from AGENTS.md). Extends inventory.yaml with a stable service contract (doc_page, config_repo, risk_notes) on all 17 services, and a structured archaeology: section for the 13 destroyed LXCs (was scattered comments + a narrative table). Fixes stale drift found in the process: authentik's backend pointed at a retired LXC (124); core has run on the VPS since 2026-05-31. Adds oikos/gen-topology.py, generating infrastructure/topology.md (Mermaid compute/ingress + storage views) from inventory.yaml. build_host_files.py now carries state/storage/depends_on into generated hosts/*.yaml. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
118 lines
4.3 KiB
YAML
118 lines
4.3 KiB
YAML
# Oikos risk & approval policy — machine-readable safety model.
|
|
#
|
|
# Every operation an agent can perform maps to exactly one risk class.
|
|
# The decision classifier (oikos/decide.py, Week 3) and the homelab CLI
|
|
# consult this file before executing; agents consult it before proposing.
|
|
# See OIKOS.md for the operating model.
|
|
#
|
|
# Autonomy default (operator decision 2026-07-05): unattended agents may
|
|
# perform read_only and reversible_low actions; config_mutation and
|
|
# destructive always require operator approval.
|
|
|
|
risk_classes:
|
|
read_only:
|
|
description: Observes state; cannot change anything.
|
|
approval: none
|
|
ledger: false
|
|
reversible_low:
|
|
description: >-
|
|
Changes runtime state in a way a single follow-up command undoes
|
|
(restart, cache clear, sync pull). No config or data changes.
|
|
approval: none
|
|
ledger: true # every mutation leaves a ledger entry
|
|
config_mutation:
|
|
description: >-
|
|
Changes tracked configuration or deployed software: repo edit + push,
|
|
deploy pipeline trigger, Caddy/Gitea/app config, package upgrades.
|
|
Reversible via git, but affects other consumers.
|
|
approval: operator # Matrix ✅/❌ reaction (Week 3 approval engine)
|
|
ledger: true
|
|
destructive:
|
|
description: >-
|
|
Destroys or irreversibly alters data/entities: container destroy,
|
|
disk format, DB wipe, secret rotation, client revocation.
|
|
approval: operator_confirmed # approval + typed confirmation phrase
|
|
ledger: true
|
|
|
|
# Lifecycle gates (see ontology.yaml lifecycle):
|
|
# provisioning: config_mutation downgraded to reversible_low (no dependents yet)
|
|
# deprecated: adding new inbound edges (depends-on/routes-to) is refused
|
|
# destroyed: any action targeting the entity raises a drift signal
|
|
lifecycle_overrides:
|
|
provisioning:
|
|
config_mutation: reversible_low
|
|
deprecated:
|
|
refuse: [new-inbound-edges]
|
|
destroyed:
|
|
refuse: [all]
|
|
|
|
# homelab CLI subcommands → risk class
|
|
commands:
|
|
whoami: read_only
|
|
list: read_only
|
|
status: read_only
|
|
logs: read_only
|
|
open: read_only
|
|
ssh-keyscan: read_only
|
|
apt-audit: read_only
|
|
mcp: read_only # MCP tools are individually classified below
|
|
secret: read_only # decrypt-to-stdout; never write secrets to files/docs
|
|
ssh: read_only # interactive shell itself; actions inside it carry
|
|
# their own class — agents must not use raw ssh to
|
|
# bypass policy (HERMES.md convention)
|
|
sync: reversible_low
|
|
refresh-creds: reversible_low
|
|
ssh-config: reversible_low # rewrites ~/.ssh/config, regenerable
|
|
apt-upgrade: config_mutation
|
|
render-vps-configs: config_mutation
|
|
client-add: config_mutation
|
|
client-remove: destructive # revokes key + re-keys all secrets
|
|
|
|
# MCP tools → risk class (all currently read-only by design)
|
|
mcp_tools:
|
|
get_host: read_only
|
|
list_services: read_only
|
|
find_service: read_only
|
|
get_topology: read_only
|
|
search_docs: read_only
|
|
get_page: read_only
|
|
get_changelog: read_only
|
|
whoami: read_only
|
|
get_service_status: read_only
|
|
tail_log: read_only
|
|
list_lxcs: read_only
|
|
get_lxc_state: read_only
|
|
ping_service: read_only
|
|
list_my_secrets: read_only
|
|
|
|
# Common operational actions (not yet CLI subcommands) → risk class.
|
|
# Used by agents to classify ad-hoc work until Week 2/3 wraps them in
|
|
# `homelab service` / runbooks.
|
|
actions:
|
|
service-restart: reversible_low
|
|
cache-clear: reversible_low
|
|
docker-compose-restart: reversible_low
|
|
tracked-config-edit: config_mutation # commit+push to config repo, never local edit
|
|
deploy-webhook-trigger: config_mutation
|
|
lxc-create: config_mutation # new entity, state: provisioning
|
|
lxc-migrate: config_mutation
|
|
dns-record-change: config_mutation
|
|
ingress-route-change: config_mutation
|
|
secret-rotate: destructive
|
|
lxc-destroy: destructive
|
|
disk-format: destructive
|
|
db-wipe: destructive
|
|
storage-pool-change: destructive
|
|
|
|
# Per-service overrides (schema ready; populate as needs emerge).
|
|
# Example:
|
|
# jellyfin:
|
|
# service-restart: reversible_low # default anyway
|
|
# caddy:
|
|
# service-restart: config_mutation # wide blast radius: all ingress
|
|
service_overrides:
|
|
caddy:
|
|
service-restart: config_mutation # everything *.hubris.network rides on it
|
|
dns:
|
|
service-restart: config_mutation # LAN-wide resolver
|