{
  "release": "0.12.7",
  "source_commit": "192e590345c6a4bf1ef8f72b043b318084ea84d6",
  "binary_sha256": "45a7ae62c66c15693790de1905b72502b75e7889682e4e58cbb4e88756ba6879",
  "scope": "35 public fields from six pinned Go types and default constructors, with source-verified admission annotations; not a JSON Schema or proof of live policy execution.",
  "policy_environment": "No environment replacement for policy fields. SONNY_POLICY is ignored with a warning; SONNY_UPSTREAM_TOKEN authenticates only the operator-selected registry transport.",
  "policy_precedence": "Explicit --config, otherwise home operator block. A trusted working-directory policy block replaces it entirely; untrusted blocks and all project registry blocks are ignored. Workspace revocation falls back to the operator block.",
  "permission_precedence": "Defaults, organization, machine, user trusted files. Allow ceilings intersect; requests use last explicit value. Environment requests override file requests; explicit invocation flags have higher request rank. Neither requests nor flags restore a denied grant or bypass an isolation floor.",
  "application": "Read for a new process/session or policy inspection; existing session bindings and activation/revocation are separate runtime contracts. Editing a file is not a reload or completed activation.",
  "groups": [
    {
      "path": "policy",
      "source": "cmd/sonny/policywire/settings.go",
      "fields": [
        {
          "name": "mode",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "off",
          "path": "policy.mode",
          "example": "off",
          "contract": "off, shadow or active. Off skips active-setting bounds; unknown keys and wrong JSON types are still refused.",
          "environment": [],
          "flags": [],
          "file_key": "policy.mode",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "source",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "",
          "path": "policy.source",
          "example": "/owned/policy.rule",
          "contract": "Absolute policy-file path. In shadow/active, select exactly one origin: source, pack or registry. Parsing a path does not load the file.",
          "environment": [],
          "flags": [],
          "file_key": "policy.source",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "pack",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "",
          "path": "policy.pack",
          "example": "session",
          "contract": "The only nonempty pack value is session. Uses the session Recipe decision_policy; a Recipe without one can run without a decision policy.",
          "environment": [],
          "flags": [],
          "file_key": "policy.pack",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "registry",
          "go_type": "*policywire.RegistrySettings",
          "omit_empty": true,
          "pointer": true,
          "has_default": true,
          "default": null,
          "path": "policy.registry",
          "example": null,
          "contract": "Optional operator-only registry object; mutually exclusive with source and pack. No registry is configured by default.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "format",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "source",
          "path": "policy.format",
          "example": "source",
          "contract": "source or ast_json.",
          "environment": [],
          "flags": [],
          "file_key": "policy.format",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "worker",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "",
          "path": "policy.worker",
          "example": "/owned/dpolicy-worker",
          "contract": "Absolute worker path in shadow/active. The executable identity is pinned by the Sonny build, not a configurable hash; parsing does not verify or start it.",
          "environment": [],
          "flags": [],
          "file_key": "policy.worker",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "test_tool",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "exec",
          "path": "policy.test_tool",
          "example": "exec",
          "contract": "Nonempty tool name. This declaration grants no tool permission.",
          "environment": [],
          "flags": [],
          "file_key": "policy.test_tool",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "test_command",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "",
          "path": "policy.test_command",
          "example": "owned-test-command",
          "contract": "Required in active mode. An executable command is operator-reviewed configuration, not a generic recovery command.",
          "environment": [],
          "flags": [],
          "file_key": "policy.test_command",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "grant",
          "go_type": "[]string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": [
            "artifact.read",
            "artifact.review",
            "artifact.revise",
            "artifact.test"
          ],
          "path": "policy.grant",
          "example": [
            "artifact.read"
          ],
          "contract": "Subset of artifact.read, artifact.review, artifact.revise and artifact.test; empty grants none. Runtime admission and inherited restrictions still apply.",
          "environment": [],
          "flags": [],
          "file_key": "policy.grant",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "verify_protect",
          "go_type": "[]string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": [
            "*_test.go",
            "*_test.py",
            "test_*.py",
            "*.test.js",
            "*.test.ts",
            "*.spec.js",
            "*.spec.ts",
            "**/test/**",
            "**/tests/**",
            "**/testdata/**",
            "**/__tests__/**"
          ],
          "path": "policy.verify_protect",
          "example": [
            "*_test.go"
          ],
          "contract": "Protected verification paths; patterns are checked with path.Match after replacing ** with *. Invalid patterns are refused in shadow/active.",
          "environment": [],
          "flags": [],
          "file_key": "policy.verify_protect",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "fuel",
          "go_type": "uint32",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": 1000,
          "path": "policy.fuel",
          "example": 1000,
          "contract": "Unsigned 32-bit integer; shadow/active require 1..10000 evaluation steps.",
          "environment": [],
          "flags": [],
          "file_key": "policy.fuel",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "budget",
          "go_type": "policywire.Budget",
          "omit_empty": false,
          "pointer": false,
          "has_default": true,
          "default": {
            "decisions": 40,
            "actions": 20,
            "retries": 6,
            "wall_ms": 1800000,
            "model_tokens": 4000000
          },
          "path": "policy.budget",
          "example": {
            "decisions": 40,
            "actions": 20,
            "retries": 6,
            "wall_ms": 1800000,
            "model_tokens": 4000000
          },
          "contract": "Per-episode bounds, not a model-account spending guarantee.",
          "environment": [],
          "flags": [],
          "file_key": "policy.budget",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "state_dir",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": "<state>/policy (CLI-supplied; platform-dependent)",
          "path": "policy.state_dir",
          "example": "/owned-state/policy",
          "contract": "Absolute state directory in shadow/active. The CLI supplies <state>/policy as its default; the owned path in source fixtures is an injected test base.",
          "environment": [],
          "flags": [],
          "file_key": "policy.state_dir",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "delegation",
          "go_type": "runtime.ChildDelegation",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": {
            "depth": 0,
            "children": 0
          },
          "path": "policy.delegation",
          "example": {
            "depth": 0,
            "children": 0
          },
          "contract": "Both zero disable delegation; otherwise depth 1..32 and children 1..64. Delegation cannot widen inherited authority.",
          "environment": [],
          "flags": [],
          "file_key": "policy.delegation",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        }
      ]
    },
    {
      "path": "policy.registry",
      "source": "cmd/sonny/policywire/registry.go",
      "fields": [
        {
          "name": "url",
          "go_type": "string",
          "omit_empty": false,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.url",
          "example": "https://registry.example.invalid",
          "contract": "HTTPS origin; plain HTTP is admitted only for a loopback host with insecure_http=true. Syntax acceptance does not qualify registry access.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.url",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "tenant",
          "go_type": "string",
          "omit_empty": false,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.tenant",
          "example": "owned-tenant",
          "contract": "Required: 1..128 bytes, no Unicode whitespace or control characters.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.tenant",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "channel",
          "go_type": "string",
          "omit_empty": false,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.channel",
          "example": "review",
          "contract": "Required: ^[a-z][a-z0-9._-]{0,63}$.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.channel",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "task",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.task",
          "example": "",
          "contract": "Empty uses the session Recipe ID as the task category.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.task",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "trusted_keys",
          "go_type": "map[string]string",
          "omit_empty": false,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.trusted_keys",
          "example": {},
          "contract": "At least one keyed Ed25519 public key is required: standard base64 raw key, PEM or OpenSSH. An empty map shown here is a value shape and is not a valid configured registry.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.trusted_keys",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "baseline",
          "go_type": "*policywire.BaselineSettings",
          "omit_empty": true,
          "pointer": true,
          "has_default": false,
          "path": "policy.registry.baseline",
          "example": null,
          "contract": "Optional pinned fallback baseline. This does not make an unavailable registry or missing eligibility proof safe.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.baseline",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "insecure_http",
          "go_type": "bool",
          "omit_empty": true,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.insecure_http",
          "example": false,
          "contract": "Boolean opt-in for a loopback HTTP registry only; it does not permit arbitrary insecure origins.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.insecure_http",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        }
      ]
    },
    {
      "path": "policy.registry.baseline",
      "source": "cmd/sonny/policywire/registry.go",
      "fields": [
        {
          "name": "digest",
          "go_type": "string",
          "omit_empty": false,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.baseline.digest",
          "example": "<approved AST digest>",
          "contract": "Required when baseline is present; must pass the release digest parser. The placeholder is not a usable digest.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.baseline.digest",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        },
        {
          "name": "mode",
          "go_type": "string",
          "omit_empty": true,
          "pointer": false,
          "has_default": false,
          "path": "policy.registry.baseline.mode",
          "example": "shadow",
          "contract": "Empty, shadow or active; baseline cannot run above the configured policy mode.",
          "environment": [],
          "flags": [],
          "file_key": "policy.registry.baseline.mode",
          "trust_scope": "Operator configuration only; project registry blocks are ignored even in trusted workspaces."
        }
      ]
    },
    {
      "path": "policy.budget",
      "source": "cmd/sonny/policywire/settings.go",
      "fields": [
        {
          "name": "decisions",
          "go_type": "uint64",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": 40,
          "path": "policy.budget.decisions",
          "example": 40,
          "contract": "Unsigned 64-bit integer; positive in shadow/active.",
          "environment": [],
          "flags": [],
          "file_key": "policy.budget.decisions",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "actions",
          "go_type": "uint64",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": 20,
          "path": "policy.budget.actions",
          "example": 20,
          "contract": "Unsigned 64-bit integer; positive in shadow/active.",
          "environment": [],
          "flags": [],
          "file_key": "policy.budget.actions",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "retries",
          "go_type": "uint64",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": 6,
          "path": "policy.budget.retries",
          "example": 0,
          "contract": "Unsigned 64-bit integer; zero is valid and disables retrying a failed action as that action.",
          "environment": [],
          "flags": [],
          "file_key": "policy.budget.retries",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "wall_ms",
          "go_type": "uint64",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": 1800000,
          "path": "policy.budget.wall_ms",
          "example": 1800000,
          "contract": "Unsigned 64-bit integer; positive milliseconds in shadow/active.",
          "environment": [],
          "flags": [],
          "file_key": "policy.budget.wall_ms",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "model_tokens",
          "go_type": "uint64",
          "omit_empty": true,
          "pointer": false,
          "has_default": true,
          "default": 4000000,
          "path": "policy.budget.model_tokens",
          "example": 4000000,
          "contract": "Unsigned 64-bit integer; positive in shadow/active.",
          "environment": [],
          "flags": [],
          "file_key": "policy.budget.model_tokens",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        }
      ]
    },
    {
      "path": "policy.delegation",
      "source": "internal/runtime/child_delegation.go",
      "fields": [
        {
          "name": "depth",
          "go_type": "uint32",
          "omit_empty": false,
          "pointer": false,
          "has_default": true,
          "default": 0,
          "path": "policy.delegation.depth",
          "example": 0,
          "contract": "Unsigned 32-bit integer: both delegation members zero, or depth 1..32 with children 1..64.",
          "environment": [],
          "flags": [],
          "file_key": "policy.delegation.depth",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        },
        {
          "name": "children",
          "go_type": "uint32",
          "omit_empty": false,
          "pointer": false,
          "has_default": true,
          "default": 0,
          "path": "policy.delegation.children",
          "example": 0,
          "contract": "Unsigned 32-bit integer: both delegation members zero, or children 1..64 with depth 1..32.",
          "environment": [],
          "flags": [],
          "file_key": "policy.delegation.children",
          "trust_scope": "Operator block, or a trusted workspace block replacing it as a whole. Host metadata and inherited delegation limits cannot be granted by a file."
        }
      ]
    },
    {
      "path": "permissions.yaml",
      "source": "cmd/sonny/permissionpolicy/config.go",
      "fields": [
        {
          "name": "version",
          "go_type": "int",
          "omit_empty": false,
          "pointer": false,
          "has_default": true,
          "default": 1,
          "path": "permissions.yaml.version",
          "example": 1,
          "contract": "Required literal integer 1 in each file; the built-in version is not an implicit default for a document that omits it.",
          "environment": [],
          "flags": [],
          "file_key": "version",
          "trust_scope": "Organization, machine and user protected permissions.yaml only; project files cannot grant these settings."
        },
        {
          "name": "allow_auto_approve",
          "go_type": "*bool",
          "omit_empty": false,
          "pointer": true,
          "has_default": true,
          "default": true,
          "path": "permissions.yaml.allow_auto_approve",
          "example": false,
          "contract": "Optional boolean permission ceiling, intersected across layers. False cannot be restored to true by a later layer. True permits a request but does not enable auto-approval.",
          "environment": [
            "SONNY_POLICY_FORBID_AUTO_APPROVE"
          ],
          "flags": [],
          "file_key": "allow_auto_approve",
          "trust_scope": "Organization, machine and user protected permissions.yaml only; project files cannot grant these settings."
        },
        {
          "name": "allow_isolation_bypass",
          "go_type": "*bool",
          "omit_empty": false,
          "pointer": true,
          "has_default": true,
          "default": true,
          "path": "permissions.yaml.allow_isolation_bypass",
          "example": false,
          "contract": "Optional boolean ceiling, intersected across layers. It does not override a trusted isolation floor.",
          "environment": [
            "SONNY_POLICY_FORBID_ISOLATION_BYPASS"
          ],
          "flags": [],
          "file_key": "allow_isolation_bypass",
          "trust_scope": "Organization, machine and user protected permissions.yaml only; project files cannot grant these settings."
        },
        {
          "name": "auto_approve",
          "go_type": "*bool",
          "omit_empty": false,
          "pointer": true,
          "has_default": true,
          "default": false,
          "path": "permissions.yaml.auto_approve",
          "example": false,
          "contract": "Optional boolean request, last explicit trusted layer wins, subject to the composed permission ceiling. Cannot be true in a layer that also sets allow_auto_approve=false.",
          "environment": [
            "SONNY_DANGEROUSLY_AUTO_APPROVE_TOOLS",
            "SONNY_DANGEROUSLY_BYPASS_ALL"
          ],
          "flags": [
            "--dangerously-auto-approve-tools",
            "--dangerously-bypass-all"
          ],
          "file_key": "auto_approve",
          "trust_scope": "Organization, machine and user protected permissions.yaml only; project files cannot grant these settings."
        },
        {
          "name": "bypass_isolation",
          "go_type": "*bool",
          "omit_empty": false,
          "pointer": true,
          "has_default": true,
          "default": false,
          "path": "permissions.yaml.bypass_isolation",
          "example": false,
          "contract": "Optional boolean request, last explicit trusted layer wins, subject to ceilings and the isolation floor. Cannot be true beside allow_isolation_bypass=false.",
          "environment": [
            "SONNY_DANGEROUSLY_BYPASS_ISOLATION",
            "SONNY_DANGEROUSLY_BYPASS_ALL"
          ],
          "flags": [
            "--dangerously-bypass-isolation",
            "--dangerously-bypass-all"
          ],
          "file_key": "bypass_isolation",
          "trust_scope": "Organization, machine and user protected permissions.yaml only; project files cannot grant these settings."
        }
      ]
    }
  ]
}