core

README

osg-core

Policy & egress engine
Canonical policy schema, L4/L7 allowlists, host patterns, TOFU, and env placeholders.

_{Part of the zorneth / osg ecosystem}

---

Overview

osg-core is the shared policy library for osg. Every data-plane and control-plane component evaluates egress and filesystem rules from this schema.

Key Features

Category	Capabilities
Schema	filesystem_policy, landlock, network_policies, inference, display, credentials
Engine	Default-deny allowlist with L7 REST / GraphQL / MCP matching
Hosts	Glob host patterns (**.example.com), ports, binaries, credential binding
Inference	Builtin provider presets (anthropic, openai, local → host.osg.internal)
Safety	Binary TOFU store, env placeholder expansion for guest inject

---

Installation

go get github.com/zorneth/osg-core@latest

Requirements: Go 1.27+

---

Quick Start

package main

import (
    "fmt"

    "github.com/zorneth/osg-core/engine"
    "github.com/zorneth/osg-core/policy"
)

func main() {
    doc, err := policy.Load("policy.yaml")
    if err != nil {
        panic(err)
    }
    var al engine.Allowlist
    if err := al.Apply(doc); err != nil {
        panic(err)
    }
    d, _ := al.Decide(nil, engine.EgressRequest{Host: "api.github.com", Port: 443})
    fmt.Println(d.Allow, d.Reason)
}

---

Package Structure

Package	Purpose
policy/	Document load/validate, L7 rules, inference presets
engine/	Allowlist Decide / DecideHTTP
hostpattern/	Host glob matching
tofu/	Trust-on-first-use binary fingerprints
env/	Host→guest credential placeholder helpers
defaults/	Shared paths and image names

---

Related

Resource	Link
Roadmap	ROADMAP.md
Organization	https://github.com/zorneth
Organization overview	github.com/zorneth
pkg.go.dev	github.com/zorneth/osg-core

License

MIT © zorneth

Documentation

Overview

Package core holds shared identity and error primitives for osg modules.

Index

• Variables
• type ID

Variables

var ErrNotImplemented = errNotImplemented{}

Types

type ID

type ID string

ID is an opaque sandbox or resource identifier.