Align Docker and Prime network policy modes

[xeophon]

Overview

Align Docker and Prime execution-time network policy modes while preserving framework access for explicit framework-only policies.

Details

Empty allowlists and blocklists containing * normalize to a stable framework-only state. Framework-only access takes precedence during task/runtime composition, so later allow or deny entries cannot widen it.

Docker keeps framework routes as privileged proxy routes. Prime uses its normal allowlist path for framework-only and concrete allowlist modes, automatically adding framework hosts. Ordinary Prime denylists are passed through unchanged because the Prime API accepts either allow or deny rules, not exceptions combining both.

Non-empty concrete allowlists and ordinary blocklists remain mutually exclusive. Runtime and task policy documentation describes the shared composition and runtime-specific framework-route behavior.

---

Note

Medium Risk
Configs that previously set both a concrete allowlist and a blocklist will now fail at validation; egress behavior changes for edge cases (wildcard block, task/runtime merges) affect sandbox isolation during agent execution.

Overview
Docker and Prime execution-time egress now share the same rules in NetworkPolicyConfig: empty allow or any block entry containing * normalizes to framework-only (allow=[], block=["*"]), and a non-empty concrete allow list cannot coexist with a non-empty block list (validation error at config load).

Task/runtime composition treats framework-only as absorbing—if the task or runtime side requests framework-only access, the merged policy stays framework-only instead of widening with later allow/deny entries. Otherwise concrete allowlists and blocklists merge separately (still subject to mutual exclusivity after normalization).

Prime skips validate_egress_lists for framework-only allow mode, deduplicates interception/MCP hostnames before building allow policies, and applies ordinary denylists to the platform without folding in framework hosts (matching Prime’s allow-or-deny API). Docs and field help for Docker, Prime, tasks, and evaluation describe the shared modes and runtime-specific framework-route behavior.

^{Reviewed by Cursor Bugbot for commit a3342a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Align Docker and Prime network policy modes with mutually exclusive allow/block semantics

• Updates NetworkPolicyConfig in base.py to enforce that non-empty concrete allowlists and blocklists are mutually exclusive, and normalizes wildcard block ('*') or empty allow to framework-only.
• Updates with_task_network_policy composition so that if either side is framework-only or uses a wildcard block, the result is always framework-only; otherwise allowlists and blocklists are merged with de-duplication.
• Refactors Prime egress validation in prime.py to rely on earlier normalization and de-duplicates route hostnames before composing the allow list.
• Updates docs and config reference to document the new mutually exclusive modes and normalization rules.
• Risk: task.py contains a syntax error introduced in the docstring update that will prevent the module from importing.

^{Macroscope summarized a3342a1.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 08c9a63641

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 860ec75954

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in a3342a1. This PR modifies network policy validation and composition logic with runtime security implications. Three unresolved review comments identify potential bugs where compatible policies may be rejected, wildcard blocks may incorrectly block framework routes, and CIDR deny rules may block framework endpoints.

^{You can customize Macroscope's approvability policy. Learn more.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a6716d9626

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a6716d9. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23e0ab53ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".