Skip to content

Sensorium Command Profile v1

Source schema: doc/schemas/sensorium-command-profile.v1.schema.json

Declarative command profile for local Sensorium actuation. The profile describes argv-as-data admission, cwd roots, env policy, and bounded output/timeout limits; it does not execute commands.

Governing Basis

Project Lineage

Requirements

Stories

Fields

Field Required Shape Description
schema yes const: sensorium-command-profile.v1
schema/v yes const: 1
command.profile/ref yes ref: #/$defs/ref
executable yes ref: #/$defs/argvAtom
fixed_args no array
allowed_arg_prefixes no array Allowed prefixes for variable argv atoms after executable and fixed_args. An empty list means no variable argv atoms are allowed.
allowed_workspace_roots yes array Explicit allowlist of workspace root refs. The list is required to be non-empty; filesystem authority is default-deny.
env yes ref: #/$defs/envPolicy
network no ref: #/$defs/networkPolicy Profile-level network policy. The Workbench hard-MVP contract admits only no-egress/local-only policy values; any future egress grant must use a separate capability contract.
limits yes ref: #/$defs/commandLimits

Definitions

Definition Shape Description
ref string
argvAtom string
envKey string
envPolicy unspecified
commandLimits object
networkPolicy unspecified
## Field Semantics

schema

  • Required: yes
  • Shape: const: sensorium-command-profile.v1

schema/v

  • Required: yes
  • Shape: const: 1

command.profile/ref

  • Required: yes
  • Shape: ref: #/$defs/ref

executable

  • Required: yes
  • Shape: ref: #/$defs/argvAtom

fixed_args

  • Required: no
  • Shape: array

allowed_arg_prefixes

  • Required: no
  • Shape: array

Allowed prefixes for variable argv atoms after executable and fixed_args. An empty list means no variable argv atoms are allowed.

allowed_workspace_roots

  • Required: yes
  • Shape: array

Explicit allowlist of workspace root refs. The list is required to be non-empty; filesystem authority is default-deny.

env

  • Required: yes
  • Shape: ref: #/$defs/envPolicy

network

  • Required: no
  • Shape: ref: #/$defs/networkPolicy

Profile-level network policy. The Workbench hard-MVP contract admits only no-egress/local-only policy values; any future egress grant must use a separate capability contract.

limits

  • Required: yes
  • Shape: ref: #/$defs/commandLimits

Definition Semantics

$defs.ref

  • Shape: string

$defs.argvAtom

  • Shape: string

$defs.envKey

  • Shape: string

$defs.envPolicy

  • Shape: unspecified

$defs.commandLimits

  • Shape: object

$defs.networkPolicy

  • Shape: unspecified