Align Docker and Prime network policy modes

[xeophon]

Overview

Align Docker and Prime execution-time network policy modes while preserving framework access for explicit framework-only policies.

Details

Empty allowlists and blocklists containing * normalize to a stable framework-only state. Framework-only access takes precedence during task/runtime composition, so later allow or deny entries cannot widen it.

Docker keeps framework routes as privileged proxy routes. Prime uses its normal allowlist path for framework-only and concrete allowlist modes, automatically adding framework hosts. Ordinary Prime denylists are passed through unchanged because the Prime API accepts either allow or deny rules, not exceptions combining both.

Non-empty concrete allowlists and ordinary blocklists remain mutually exclusive. Runtime and task policy documentation describes the shared composition and runtime-specific framework-route behavior.

---

Note

Medium Risk
Changes egress policy validation and task/runtime merge semantics in a security-sensitive path; the main behavioral break is rejecting mixed concrete allow+block configs at construction time.

Overview
Aligns Docker and Prime execution-time egress policy so both runtimes share the same mutually exclusive modes, normalization, and task/runtime merge rules.

NetworkPolicyConfig now normalizes empty allow or any block containing * to framework-only (allow=[], block=["*"]) and rejects non-empty concrete allow together with any block at config construction. with_task_network_policy treats framework-only as absorbing: if either side is framework-only, the merged policy stays framework-only instead of widening access.

Prime skips validate_egress_lists in framework-only mode and always deduplicates interception/MCP hostnames before building allowlist policy in prepare_execution. Docs (evaluation, Harbor, reference) describe shared composition, Docker framework-route precedence over denylists, and Prime ordinary denylists passing through unchanged (including possible blocks on framework hosts).

Breaking: configs that previously combined a concrete allowlist with a blocklist now raise ValueError when parsed.

^{Reviewed by Cursor Bugbot for commit 5b30069. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Align Docker and Prime network policy modes to reject mixed allowlist/blocklist configurations

• Adds a @model_validator to NetworkPolicyConfig in base.py that normalizes empty allowlists or any blocklist containing * to framework-only (allow=[], block=["*"]), and raises ValueError when a non-empty concrete allowlist is combined with any blocklist.
• Updates with_task_network_policy so framework-only is absorbing: if either side is framework-only, the result is framework-only; otherwise concrete allow and block lists are merged with deduplication.
• Simplifies PrimeConfig._validate_egress in prime.py to skip validation in framework-only mode and normalizes wildcard/empty lists before calling validate_egress_lists.
• Updates docs and reference files to document mutually exclusive modes, precedence rules (Docker framework routes take precedence over denylists; Prime passes ordinary denylists through unchanged), and task/runtime merge semantics.
• Behavioral Change: previously valid configs combining a concrete allowlist with a blocklist now raise a ValueError at construction time.

^{Macroscope summarized 5b30069.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 08c9a63641

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 860ec75954

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 5b30069. This PR modifies network policy validation and composition logic that controls egress filtering for sandboxed execution. Changes to security-relevant functionality like network access controls warrant human review to verify the intended behavior alignment between Docker and Prime runtimes.

^{You can customize Macroscope's approvability policy. Learn more.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a6716d9626

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a6716d9. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23e0ab53ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[hallerite]

lgtm

Superseded by verified signed commit 5b30069; approval will be resubmitted on the signed head.

[hallerite]

Reviewed verified signed head 5b30069. Network-policy composition looks sound, and the documentation now matches the Docker and Prime behavior.