{
  "//": "Read sandbox for the issue-fix agent. This step's environment holds BOTH",
  "//2": "a Gitea issue-write token and a repo push token, so the agent's Read tool",
  "//3": "is denied access to anything that could hold credentials: the container's",
  "//4": "/proc (env var dumps via /proc/self/environ), /root and /home (SSH keys,",
  "//5": ".netrc, git-credential stores), /etc, and the repo's own .git/ (which can",
  "//6": "carry an embedded clone token). The repo checkout itself stays readable",
  "//7": "and writable — this agent's job is to edit ansible/, opentofu/,",
  "//8": "kubernetes/ and ci/images/ — as does /tmp/alert-fix/ (the issue body it",
  "//9": "is asked to fix).",
  "//10": "Matters here because the agent's edits are pushed to a branch and its",
  "//11": "summary is posted as a PR body / issue comment on a PUBLIC repo, so an",
  "//12": "unsandboxed Read gives a prompt-injected instruction a read-then-publish",
  "//13": "exfil path. Denying .git/ also keeps the agent away from the push",
  "//14": "credential the pipeline's own git commands use.",
  "//15": "Mirrors ci/agents/update-audit/settings.json; see gitea issue #197.",
  "//16": "Verified empirically against Claude Code 2.1.207: relative deny globs",
  "//17": "anchor to the pipeline's cwd (repo root), not this file's directory.",
  "permissions": {
    "deny": [
      "Read(//proc/**)",
      "Read(//root/**)",
      "Read(//home/**)",
      "Read(//etc/**)",
      "Read(.git/**)"
    ]
  }
}