project.no-network-no-eval@1

What it is

URI

majordomus://rule/project.no-network-no-eval@1

Kind

rule

Identity

project.no-network-no-eval@1

Path

.ai/repo/rules/project/no-network-no-eval.v1.md

Provenance

declared

Media type

text/markdown

As a capability

rule.project.no-network-no-eval@1

Front matter

{
  "id": "project.no-network-no-eval",
  "version": 1,
  "kind": "rule",
  "title": "No network, no telemetry, no eval, no silent overwrite, no recursive deletion",
  "description": "bin/, lib/, share/ and test/ contain no telemetry, no eval, no curl piped to a shell, no silent overwrite, no recursive deletion outside a temporary directory, and no network client but the one declared exception SECURITY.md names.",
  "statement": "bin/, lib/, share/ and test/ contain no telemetry, no eval, no curl piped to a shell, no silent overwrite, no recursive deletion outside a temporary directory, and no network client but the one declared exception SECURITY.md names.",
  "status": "active",
  "class": "blocking",
  "depends_on": [],
  "tags": [
    "security"
  ],
  "x-majordomus": {
    "tests": [
      "test/cases/08_no_forbidden_constructs.sh"
    ]
  }
}

Content

---
id: project.no-network-no-eval
version: 1
kind: rule
title: No network, no telemetry, no eval, no silent overwrite, no recursive deletion
description: bin/, lib/, share/ and test/ contain no telemetry, no eval, no curl piped to a shell, no silent overwrite, no recursive deletion outside a temporary directory, and no network client but the one declared exception SECURITY.md names.
statement: bin/, lib/, share/ and test/ contain no telemetry, no eval, no curl piped to a shell, no silent overwrite, no recursive deletion outside a temporary directory, and no network client but the one declared exception SECURITY.md names.
status: active
class: blocking
depends_on: []
tags: [security]

x-majordomus:
  tests: [test/cases/08_no_forbidden_constructs.sh]
---

# Rationale

SECURITY.md states these as commitments; a commitment without a scan is a hope.

# Required behaviour

bin/, lib/, share/ and test/ contain no telemetry, no eval, no curl piped to a shell, no silent overwrite, no recursive deletion outside a temporary directory, and no network client but the one declared exception SECURITY.md names.

The exception is `majordomus context` reading the peer board of the shared MCP server this repository itself started, at the loopback URL in that server's own lease. It is one call site in `lib/context.sh`, bounded by `--max-time`, guarded to loopback, and silent on any failure. An exception is declared here and held to its shape by the scan; it is not a precedent for a second one.

# Failure behaviour

No command decides this rule; a reviewer does, and a change that violates it is not merged. Where a behavioural case covers part of it, that case is named below.

# Verification

Review. test/cases/08_no_forbidden_constructs.sh scans the sources for every construct named here.