{
  "schema_version": "1.0",
  "version": "2026-09-27-fleet-integration-2026-09-23-r5",
  "public_safe": true,
  "purpose": "Portable outbound network policy for Prosper AI runtimes. It describes the expected controls; it does not configure or prove enforcement on a host.",
  "definition": "Egress is network traffic initiated from a runtime to another destination. This contract governs where an AI runtime may connect and what data it may send.",
  "default_policy": "Deny outbound destinations by default. Allow only exact, task-required destinations through an authenticated, approved connector or host-level network rule. Use the narrowest host, port, protocol, identity, and data scope the runtime supports.",
  "allowed_destinations": [
    {
      "purpose": "public_bootstrap",
      "hostname": "inject.prospershield.io",
      "protocol": "HTTPS",
      "port": 443,
      "scope": "Public guidance files only. This host does not grant private-system access or authorization."
    },
    {
      "purpose": "model_inference",
      "hostname": "Exact official endpoint configured for the active AI provider",
      "protocol": "HTTPS",
      "port": 443,
      "scope": "Use the provider endpoint already configured for this runtime. Do not guess domains or add broad wildcards."
    },
    {
      "purpose": "supabase_data",
      "hostname": "Exact approved Supabase project endpoint",
      "protocol": "HTTPS",
      "port": 443,
      "scope": "Verify the project and environment per task. Use the authorized identity and row-level security; do not substitute another project or a broader credential."
    },
    {
      "purpose": "redis_streams",
      "hostname": "Exact private Redis endpoint configured for the runtime",
      "protocol": "TLS where supported by the configured private service",
      "port": "Exact configured service port",
      "scope": "Use only the approved private route and least-privilege identity. Never expose Redis publicly or assume another seat shares this connection."
    },
    {
      "purpose": "user_requested_web_or_task_service",
      "hostname": "Exact destination required for the authorized task",
      "protocol": "HTTPS where supported",
      "port": 443,
      "scope": "Use the runtime's approved browser or connector. Limit access to the requested resource and do not create standing access from a one-time task."
    }
  ],
  "deny_by_default": [
    "Arbitrary destinations, unbounded wildcard domains, and unapproved proxies or tunnels.",
    "Public or unauthenticated Redis, including opening a Redis listener to the internet.",
    "Cloud metadata, host-control endpoints, loopback, link-local, and private-network destinations unless a specific private service is required and separately authorized on that host.",
    "SMTP, messaging, webhooks, uploads, or other communication paths that are not needed and approved for the current task.",
    "Sending passwords, API keys, tokens, service-role keys, connection strings, raw private memory, full customer records, or legal/financial source material to an unapproved destination."
  ],
  "credential_handling": [
    "Keep secrets in the runtime's approved secret manager or connector configuration, scoped to the minimum identity and destination.",
    "Never place secret values in this public site, prompts, source control, Redis messages, URLs, or logs.",
    "A public bootstrap document is not a credential source. Never ask an operator to paste secrets into a public page or model conversation."
  ],
  "enforcement_and_failure": [
    "The host, container, browser, proxy, or connector owner must enforce the policy. Reading this file alone changes no firewall, network route, or credential.",
    "If the runtime cannot enforce or inspect outbound destinations, label enforcement UNKNOWN, use only an already approved connector, and minimize the data sent.",
    "Do not invent endpoint names, credentials, or current connectivity. A successful connection proves reachability only; it does not prove authorization, least privilege, or task completion."
  ],
  "approval_boundary": "This policy does not authorize customer messages, public posts, spending, credential or permission changes, CRM writes, database mutations, data release, or production changes. Obtain the required exact Craig approval and read back the resulting state.",
  "public_boundary": "This contract contains no live endpoints, IP addresses, credentials, private network map, customer data, or claim that a runtime's egress controls are active."
}