No network, no telemetry, no eval, no silent overwrite, no recursive deletion

majordomus://rule/project.no-network-no-eval@1active security

it references

Nothing. This object declares no reference.

referenced by

put_in_force adr-0012
put_in_force adr-0053
put_in_force adr-0069
put_in_force adr-0091
put_in_force adr-0101
put_in_force adr-0118
depends_on project.envrc-is-an-adapter@2

Rationale

SECURITY.md states these as commitments; a commitment without a scan is a hope.

bin/, lib/, share/ and test/ contain no telemetry, no eval, no curl piped to a shell, no silent overwrite, no recursive deletion outside a temporary directory, and no network client but the one declared exception SECURITY.md names.

The exception is majordomus context reading the peer board of the shared MCP server this repository itself started, at the loopback URL in that server's own lease. It is one call site in lib/context.sh, bounded by --max-time, guarded to loopback, and silent on any failure. An exception is declared here and held to its shape by the scan; it is not a precedent for a second one.

Failure behaviour

No command decides this rule; a reviewer does, and a change that violates it is not merged. Where a behavioural case covers part of it, that case is named below.

Verification

Review. test/cases/08_no_forbidden_constructs.sh scans the sources for every construct named here.

Where this comes from

canonical file: .ai/repo/rules/project/no-network-no-eval.v1.md
identity: project.no-network-no-eval@1
also served as: MCP resource majordomus://rule/project.no-network-no-eval@1 · majordomus entity show rule/project-no-network-no-eval-1 · GET /api/v1/entity?uri=majordomus://rule/project.no-network-no-eval@1
in the Cockpit: /cockpit/objects/rule/project-no-network-no-eval-1

This page is generated from the file above by scripts/generate-site-data; editing the page changes nothing, editing the file changes every surface. The relations above are edges of docs/generated/graph.json, which the executable writes from the same index.