From f45482ab9c80a04d5c5cb508dd9c65c7472341fa Mon Sep 17 00:00:00 2001 From: Nikolay Petrov Date: Sun, 1 Nov 2026 10:35:59 -0800 Subject: [PATCH 1/2] docs(network): allowlist carries HTTPS; plain-HTTP mirrors behind a host proxy need verify=public The egress sidecar forwards plain HTTP to an allowlisted host directly. It refuses one that would have to be chained through the host proxy (not in NO_PROXY) with a 403, so an apt or pip mirror reached that way fails under allowlist. A verifier that runs apt-get then needs --network verify=public (or allow_internet = true in task.toml), or the mirror host in NO_PROXY. Signed-off-by: Nikolay Petrov --- dokimi/docs/coding-harnesses.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dokimi/docs/coding-harnesses.md b/dokimi/docs/coding-harnesses.md index f673acf55..37e1da532 100644 --- a/dokimi/docs/coding-harnesses.md +++ b/dokimi/docs/coding-harnesses.md @@ -635,6 +635,13 @@ decisions land in `metrics.network.verify_egress`). Later sources win: `--network solve=allowlist:pypi.org,files.pythonhosted.org` lets every arm install packages. +Under `allowlist`, HTTPS goes through the sidecar's CONNECT proxy. A plain-HTTP +request to an allowlisted host is forwarded directly, but one that would have to +go through the host's proxy is refused with a 403. So a plain-HTTP apt or pip +mirror behind a host proxy fails there: a verifier that runs `apt-get` needs +`--network verify=public` (or `allow_internet = true` in `task.toml`, Harbor's +deprecated flag), or the mirror's host in the host's `NO_PROXY`. + A skill that needs the network at solve time declares it in its `SKILL.md` frontmatter as `metadata.network` (`allowlist:host,...` or `public`), with the reason for people in `compatibility`, the Agent Skills spec's field for From 30d6c9115354470b7897a4a36b7f3e9254caa29a Mon Sep 17 00:00:00 2001 From: Nikolay Petrov Date: Sun, 1 Nov 2026 17:27:14 -0800 Subject: [PATCH 2/2] docs(network): plain-HTTP mirrors need a port-80 allowlist entry too Signed-off-by: Nikolay Petrov --- dokimi/docs/coding-harnesses.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/dokimi/docs/coding-harnesses.md b/dokimi/docs/coding-harnesses.md index 37e1da532..b71e2fa4d 100644 --- a/dokimi/docs/coding-harnesses.md +++ b/dokimi/docs/coding-harnesses.md @@ -635,12 +635,15 @@ decisions land in `metrics.network.verify_egress`). Later sources win: `--network solve=allowlist:pypi.org,files.pythonhosted.org` lets every arm install packages. -Under `allowlist`, HTTPS goes through the sidecar's CONNECT proxy. A plain-HTTP -request to an allowlisted host is forwarded directly, but one that would have to -go through the host's proxy is refused with a 403. So a plain-HTTP apt or pip -mirror behind a host proxy fails there: a verifier that runs `apt-get` needs +Under `allowlist`, HTTPS goes through the sidecar's CONNECT proxy. A bare +allowlist entry is `host:443`, so a plain-HTTP request to that host (port 80) is +refused with a 403, "not on the allowlist". A plain-HTTP apt or pip mirror needs +its port-80 entry too, for example `--network verify=allowlist:mirror.corp,mirror.corp:80`, +and, behind a host proxy, its host in the host's `NO_PROXY`: plain HTTP is never +chained through the host's proxy, and a request that would be is refused with a 403. +If the mirror cannot be allowlisted that way, a verifier that runs `apt-get` needs `--network verify=public` (or `allow_internet = true` in `task.toml`, Harbor's -deprecated flag), or the mirror's host in the host's `NO_PROXY`. +deprecated flag). A skill that needs the network at solve time declares it in its `SKILL.md` frontmatter as `metadata.network` (`allowlist:host,...` or `public`), with