# Sandbox Policy
#
# Codifies isolation and execution constraints for any adversarial-test container.
# Aligned with SPB-10 (runtime), SPB-11 (egress), SPB-12 (audit).

version: 1

network:
  default: deny_all
  allow_outbound:
    # Empty by default. Add only with explicit approval and rationale.
    # Each entry: { fqdn: "<>", port: <>, protocol: <>, rationale: "<>" }
    []
  allow_inbound: deny_all
  dns:
    mode: deny
    exception:
      enabled: false
      resolvers: []

filesystem:
  mounts:
    # Only the target repo (read-write workspace copy) and per-test data.
    target_repo:
      mode: rw
      path: /sandbox/target
      copy_in: true     # never bind-mount the host repo directly
    test_data:
      mode: rw
      path: /sandbox/data
    findings:
      mode: rw
      path: /sandbox/findings
  forbidden_mounts:
    - host_root
    - user_home
    - user_secret_store      # SPB-03
    - cursor_workspace_root

execution:
  user: nonroot
  capabilities:
    drop: [ALL]
    add: []
  seccomp_profile: default-deny
  read_only_root_fs: true
  pid_max: 1024
  cpu_quota_pct_default: 50
  memory_limit_mb_default: 2048

time_and_resource_limits:
  max_runtime_seconds: 1800             # 30 minutes default
  max_cpu_seconds: 1800
  max_disk_mb: 4096
  abort_on_exceed: true

approvals_required:
  outbound_network: true
  bind_mount_host_path: true
  privileged_container: never
  network_inbound_listener: never

destruction:
  on_completion:
    teardown_container: true
    sanitize_workspace: true
    persist_findings_only: true

logging:
  audit_events:
    sandbox_launched: true
    sandbox_torn_down: true
    tool_invoked: true
    finding_emitted: true
    fix_applied: true
    network_attempt: true
  redaction: enforce_secret_patterns_per_SPB_09