eti.json

{
  "meta": {
    "name": "eti-schema2-compact-example",
    "version": "0.1.0",
    "status": "schema2_design_target"
  },
  "environment": {
    "deny_vars": ["AWS_*", "GITHUB_TOKEN", "GH_TOKEN", "NPM_TOKEN"]
  },
  "workdir": {
    "access": "readwrite"
  },
  "command_policies": {
    "entrypoint": "claude",
    "approval_backends": {
      "terminal": {
        "type": "terminal"
      },
      "security-review": {
        "type": "webhook",
        "url": "https://approvals.internal.example/eti",
        "timeout_secs": 30
      }
    },
    "approval_defaults": {
      "backend": "terminal",
      "timeout_secs": 60
    },
    "credentials": {
      "github-api": {
        "type": "proxy",
        "upstream": "https://api.github.com",
        "credential_key": "op://Engineering/GitHub/token",
        "env_var": "GITHUB_TOKEN",
        "base_url_env_var": "GITHUB_API_URL",
        "inject_header": "Authorization",
        "credential_format": "Bearer {}"
      },
      "git-ssh-agent": {
        "type": "local-socket",
        "path": "$SSH_AUTH_SOCK",
        "mode": "connect",
        "env_var": "SSH_AUTH_SOCK"
      }
    },
    "commands": {
      "claude": {
        "can_use": ["terraform", "gh", "ssh"],
        "sandbox": {
          "fs_read": ["."],
          "fs_write": [".", "$TMPDIR"],
          "environment": {
            "allow_vars": ["PATH", "HOME", "TMPDIR", "LANG", "LC_*"]
          },
          "resources": {
            "backend": "auto",
            "fallback": "warn_if_weaker",
            "memory_bytes": 2147483648,
            "max_processes": 128
          }
        }
      },
      "terraform": {
        "from": {
          "claude": {
            "sandbox": {
              "fs_read": ["."],
              "fs_write": [".", "$TMPDIR"],
              "environment": {
                "allow_vars": ["PATH", "HOME", "TMPDIR", "ENVIRONMENT", "TF_*"]
              },
              "resources": {
                "backend": "cgroup",
                "fallback": "fail_if_weaker",
                "memory_bytes": 1073741824,
                "cpu_seconds": 120,
                "max_processes": 32
              }
            },
            "invocation_policy": {
              "default": "deny",
              "deny": [
                {
                  "argv": {
                    "prefix": ["destroy"]
                  },
                  "reason": "destructive Terraform action"
                }
              ],
              "approve": [
                {
                  "argv": {
                    "prefix": ["apply"]
                  },
                  "env": {
                    "ENVIRONMENT": {
                      "one_of": ["STAGING", "PROD"]
                    }
                  },
                  "backend": "security-review",
                  "reason": "terraform apply mutates infrastructure"
                }
              ],
              "allow": [
                {
                  "argv": {
                    "prefix": ["plan"]
                  },
                  "env": {
                    "ENVIRONMENT": {
                      "one_of": ["STAGING", "PROD"]
                    }
                  }
                },
                {
                  "argv": {
                    "exact": ["fmt"]
                  }
                }
              ]
            }
          }
        }
      },
      "gh": {
        "from": {
          "claude": {
            "sandbox": {
              "fs_read": [".", "$HOME/.config/gh"],
              "fs_write": [".", "$TMPDIR"],
              "environment": {
                "allow_vars": ["PATH", "HOME", "GITHUB_TOKEN", "GITHUB_API_URL"]
              },
              "credentials": [
                {
                  "name": "github-api",
                  "endpoint_policy": {
                    "default": "deny",
                    "deny": [
                      {
                        "method": "*",
                        "path": "/user/installations/**",
                        "reason": "token discovery is outside this workflow"
                      }
                    ],
                    "approve": [
                      {
                        "method": "PUT",
                        "path": "/repos/acme/widget/pulls/*/merge",
                        "backend": "security-review",
                        "reason": "merging changes repository state"
                      }
                    ],
                    "allow": [
                      {
                        "method": "GET",
                        "path": "/repos/acme/widget/**"
                      },
                      {
                        "method": "POST",
                        "path": "/repos/acme/widget/issues"
                      }
                    ]
                  }
                }
              ]
            },
            "invocation_policy": {
              "default": "deny",
              "deny": [
                {
                  "argv": {
                    "prefix": ["auth"]
                  },
                  "reason": "credential management is blocked"
                }
              ],
              "approve": [
                {
                  "argv": {
                    "prefix": ["pr", "merge"]
                  },
                  "backend": "security-review",
                  "reason": "gh pr merge changes repository state"
                }
              ],
              "allow": [
                {
                  "argv": {
                    "prefix": ["api", "repos/acme/widget"]
                  }
                },
                {
                  "argv": {
                    "contains": ["--repo", "acme/widget"]
                  }
                }
              ]
            }
          }
        }
      },
      "ssh": {
        "from": {
          "claude": {
            "sandbox": {
              "credentials": ["git-ssh-agent"],
              "argv_prepend": ["-o", "IdentityFile=none"],
              "fs_read_file": ["$HOME/.ssh/known_hosts"]
            },
            "invocation_policy": {
              "default": {
                "decision": "approve",
                "backend": "terminal"
              }
            }
          }
        }
      }
    }
  }
}