From 652ccd21e7f01060c8e83d4a54cd3acb8fec8410 Mon Sep 17 00:00:00 2001 From: David McKay Date: Mon, 14 Sep 2026 11:32:40 -0700 Subject: [PATCH] Correct the CEL field list and a stray escape in the release notes The README's "CEL policy" bullet listed neither `command` nor `initiator`, both of which a rule can now inspect; architecture.md already names them. And the Unreleased changelog carried a shell single-quote escape sequence verbatim where an apostrophe belonged, which would have rendered as noise in the release notes. Documentation only; no behaviour changes. --- CHANGELOG.md | 4 ++-- README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a5e46567c..ee72aa344 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -69,8 +69,8 @@ scheduled runs as a class. `handoff` is its own kind, for a Bot that hands work **Nothing is refused that was not refused before.** The field is neutral — `{kind: "person", id: ""}` — everywhere a person is driving, which is every path that does not carry an initiator today, -including every action on a Bot'"'"'s computer: those are driven by the browser, so they really are -somebody'"'"'s session. It is required rather than optional for the reason #115 exists: cel-js throws on +including every action on a Bot's computer: those are driven by the browser, so they really are +somebody's session. It is required rather than optional for the reason #115 exists: cel-js throws on an unbound identifier and a throw fails closed, so a field that were sometimes absent would turn one rule about routines into a deployment that refused every ordinary click. diff --git a/README.md b/README.md index 72e9b5e68..e1ae4ef76 100644 --- a/README.md +++ b/README.md @@ -164,7 +164,7 @@ Leave `EMBEDDED_POSTGRES` off and set `DATABASE_URL` to point at a database you - **A computer per Bot**: the supervisor gives each Bot its own container, its own `/workspace` volume and its own browser profile. Set `COMPUTER_RUNTIME=runsc` to run them under gVisor where the host supports it. - **A shell, not just a browser**: a Bot can run a command in its workspace, install what it needs, and process a file it saved. Through the same gate as everything else, so a rule can refuse a shell outright or refuse particular commands, and the command is on the record either way. The command inherits PATH, locale, terminal and proxy variables, not the rest of the deployment's environment. - **The gateway is the only way in**: it resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer. There is no path that acts without the record existing first. -- **CEL policy, fail closed**: rules can inspect `tool.name`, `intent`, `bot.id`, `actor.id`, `page.url`, `page.host`, `element.*`, `key`, `file.*` and `mcp.*`. Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens. +- **CEL policy, fail closed**: rules can inspect `tool.name`, `intent`, `bot.id`, `actor.id`, `page.url`, `page.host`, `element.*`, `key`, `command`, `file.*`, `mcp.*` and `initiator.*` (what started the run, so a rule can refuse a scheduled routine what it would allow a person). Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens. - **Watch what it is doing**: the screen shows what a Bot is looking at, and the Activity tab beside it shows what it ran, read and saved, with the output. A command line in the transcript opens to the same thing. A saved file shows its path and size, never its contents. - **Take the wheel**: a Bot that hits a login wall or a 2FA prompt asks for help. Control is handed over in the same panel and recorded as `computer.help_requested`, `computer.control_taken` and `computer.control_released`. While a person is driving, Bot actions are refused rather than queued. - **Secrets never enter the transcript**: the trail records that a secret was requested and how long it was, not what it said.